A script detection method and device

Abstract

The present specification provides a script detection method and device, which are applied to a security detection engine that adopts an inference framework. The security detection engine is pre-loaded with an inference strategy library; the inference strategy library contains several inference strategies for inferring the adversarial means used by the adversarial statements used to counter the detection contained in the script to be detected. The method includes: in the process of running each statement contained in the script to be detected in a simulated running environment, determining whether the target statement to be executed is a suspected adversarial statement. If the target statement is a suspected adversarial statement, the inference strategy in the inference strategy library is executed to infer the adversarial means used by the target statement, and obtain adversarial information used to describe the adversarial means used by the target statement. The target statement is corrected based on the adversarial information, and the corrected target statement is executed, and whether the target statement is an adversarial statement is further determined based on the execution result.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and more specifically, the embodiments of the present specification relate to a script detection method and device. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the present specification as recited in the claims. No description herein is admitted to be prior art by inclusion in this section.

[0003] In the field of network data security, scripts with malicious behaviors usually resist the detection of security systems through various confrontation methods; in related technologies, the scripts to be detected are usually dynamically detected by simulating running in a sandbox. Therefore, some scripts have added means to resist dynamic detection, such as branch confrontation by introducing branch statements, version confrontation by using multiple language types or versions to write scripts, etc., so that conventional dynamic detection means cannot correctly identify the behavior of the scripts introduced with the confrontation means, thereby resisting dynamic detection. Summary of the invention

[0004] To overcome the problems existing in the related art, this specification provides the following methods and devices.

[0005] In a first aspect of the embodiments of the present specification, a script detection method is provided, which is applied to a security detection engine using an inference framework, wherein the security detection engine is preloaded with an inference strategy library; the inference strategy library includes several inference strategies for inferring the adversarial means used by the adversarial statements for adversarial detection contained in the script to be detected; the method includes:

[0006] In the process of running each statement contained in the script to be detected in the simulation running environment, determining whether the target statement to be executed is a suspected adversarial statement;

[0007] If the target sentence is a suspected adversarial sentence, executing the reasoning strategy in the reasoning strategy library to infer the adversarial means adopted by the target sentence, and obtaining adversarial information for describing the adversarial means adopted by the target sentence;

[0008] The target sentence is corrected based on the adversarial information, and the corrected target sentence is executed, and whether the target sentence is an adversarial sentence is further determined based on the execution result.

[0009] In a second aspect of the embodiments of the present specification, a script detection device is provided, which is applied to a security detection engine using an inference framework, wherein the security detection engine is preloaded with an inference strategy library; the inference strategy library includes several inference strategies for inferring the adversarial means used by the adversarial statements used for adversarial detection contained in the script to be detected; the device includes:

[0010] A detection unit, used to determine whether a target statement to be executed is a suspected adversarial statement during the process of running each statement included in the script to be detected in the simulated running environment;

[0011] An inference unit, configured to execute the inference strategy in the inference strategy library when determining that the target sentence is a suspected adversarial sentence, infer the adversarial means adopted by the target sentence, and obtain adversarial information for describing the adversarial means adopted by the target sentence;

[0012] A correction unit is used to correct the target sentence based on the adversarial information, execute the corrected target sentence, and further determine whether the target sentence is an adversarial sentence based on the execution result.

[0013] In a third aspect of the embodiments of the present specification, a storage medium is provided; a computer program is stored on the storage medium, and when the computer program is executed, the steps of the following method are implemented:

[0014] In the process of running each statement contained in the script to be detected in the simulation running environment, determining whether the target statement to be executed is a suspected adversarial statement;

[0015] If the target sentence is a suspected adversarial sentence, executing the reasoning strategy in the reasoning strategy library to infer the adversarial means adopted by the target sentence, and obtaining adversarial information for describing the adversarial means adopted by the target sentence;

[0016] The target sentence is corrected based on the adversarial information, and the corrected target sentence is executed, and whether the target sentence is an adversarial sentence is further determined based on the execution result.

[0017] In a fourth aspect of the embodiments of the present specification, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the following method is implemented:

[0018] In the process of running each statement contained in the script to be detected in the simulation running environment, determining whether the target statement to be executed is a suspected adversarial statement;

[0019] If the target sentence is a suspected adversarial sentence, executing the reasoning strategy in the reasoning strategy library to infer the adversarial means adopted by the target sentence, and obtaining adversarial information for describing the adversarial means adopted by the target sentence;

[0020] The target sentence is corrected based on the adversarial information, and the corrected target sentence is executed, and whether the target sentence is an adversarial sentence is further determined based on the execution result.

[0021] The above embodiments of this specification have at least the following beneficial effects:

[0022] In the above technical scheme, by integrating the reasoning strategy for reasoning adversarial statements with adversarial means in the security detection engine adopting the reasoning framework, different reasoning strategies can be enabled for adversarial statements using different adversarial means, and the adversarial means adopted by the target statement can be inferred to obtain adversarial information for describing the adversarial means adopted by the target statement. Therefore, the target statement can be corrected based on the adversarial information of the adversarial means adopted by the target statement, and the adversarial means of the script can never be quickly and accurately identified. At the same time, the reasoning strategies in the reasoning strategy library can be dynamically configured, so that the security detection engine has a high degree of adversarial resistance. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification, and for ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0024] Figure 1 The following schematically shows an architecture diagram of a script detection system according to an embodiment of the present specification;

[0025] Figure 2 A flowchart of a script detection method according to an embodiment of the present specification is schematically shown;

[0026] Figure 3 A schematic diagram schematically shows a script detection method according to an embodiment of the present specification;

[0027] Figure 4 A schematic diagram schematically shows an inference architecture of a script detection method according to an embodiment of the present specification;

[0028] Figure 5 A block diagram schematically shows a script detection device according to an embodiment of the present specification;

[0029] Figure 6 A hardware structure diagram of a computer device in which a script detection method according to an embodiment of the present specification is located is schematically shown.

[0030] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. DETAILED DESCRIPTION

[0031] The principles and spirit of this specification will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are provided only to enable those skilled in the art to better understand and implement this specification, and are not intended to limit the scope of this specification in any way. On the contrary, these embodiments are provided to make this specification more thorough and complete, and to fully convey the scope of this specification to those skilled in the art.

[0032] Those skilled in the art know that the embodiments of this specification can be implemented as a system, device, equipment, method or computer program product. Therefore, this specification can be specifically implemented in the following forms, namely: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0033] In the field of network security, scripts containing malicious behaviors will hide their malicious behaviors in various forms to bypass security detection.

[0034] For example, a script containing malicious behavior may be encrypted, packed, or processed in such a way that the security detection system cannot determine the actual purpose of the script by directly analyzing the text features of the script, or even cannot determine that the processed text is a script.

[0035] For the above processed scripts, their actual behavior can usually be verified by actually running the above scripts. However, actually running a script with malicious behavior in a real environment may lead to irreversible consequences. Therefore, it is possible to run it in a simulated environment, such as a sandbox, and perform dynamic detection to detect scripts that have been encrypted, packed, etc.

[0036] In response to the above dynamic detection, malicious behavior scripts have added targeted countermeasures. For example, some malicious scripts have added conditional countermeasures, such as adding conditional statements for the running environment to determine whether it is running in a simulated environment. If it detects that it is running in a simulated environment, it will not show malicious behavior. For example, some malicious scripts have added version countermeasures, by using different languages ​​and different versions of programming languages ​​to write malicious scripts. If the dynamic detection system does not support the language or version used by the script, it cannot be detected correctly.

[0037] In summary, the behavior of malicious scripts and detection methods are mutually antagonistic. As detection methods become more and more sophisticated, the methods of confrontation detection used by scripts can also evolve accordingly. Traditional script detection methods are difficult to cope with the increasing number of confrontation methods.

[0038] In view of this, this specification proposes a script detection method.

[0039] The scheme of this specification is described in detail below with reference to the accompanying drawings.

[0040] See also Figure 1 , Figure 1 FIG. 1 is a schematic diagram of the architecture of a script detection system provided by an exemplary embodiment. Figure 1 As shown, the system may include a network 10, a server 11, and several electronic devices, such as a mobile phone 12, a mobile phone 13, and a mobile phone 14.

[0041] The server 11 may be a physical server including an independent host, or the server 11 may be a virtual server, a cloud server, etc. hosted by a host cluster. The mobile phones 12-14 are just one type of electronic device that the user may use. In fact, the user may also use electronic devices such as tablet devices, laptop computers, PDAs (Personal Digital Assistants), wearable devices (such as smart glasses, smart watches, etc.), etc., and one or at least one embodiment of this specification does not limit this. The network 10 may include various types of wired or wireless networks.

[0042] In one embodiment, the server 11 can cooperate with the mobile phones 12-14; wherein the mobile phones 12-14 can accept user operations and upload the received commands and files to the server 11 through the network 10, and then the server 11 processes the files based on the solution of this specification. In another embodiment, the mobile phones 12-14 can independently implement the solution of this specification; wherein the mobile phones 12-14 accept user operations and process the received commands and files based on the solution of this specification to implement script detection.

[0043] See also Figure 2 , Figure 2 is a flowchart of a script detection method provided by an exemplary embodiment, the method is applied to a processing device, and the processing device can be Figure 1 The server 11 or mobile phones 12-14 etc. are shown.

[0044] The method comprises the following steps:

[0045] Step 202, in the process of running each statement included in the script to be detected in the simulation running environment, determining whether the target statement to be executed is a suspected adversarial statement;

[0046] The script to be detected may exist directly in the form of a script, or may be processed by encryption, shell obfuscation, etc., and further disguised as an ordinary document or other forms of files; this specification specifically defines the specific type of the script to be detected and the specific method of obtaining the script to be detected. For example, all unfamiliar files or file fragments scanned can be regarded as scripts to be detected.

[0047] Webshell scripts are a common malicious script targeting web servers, usually written in languages ​​such as asp, jsp, asjp or php. Webshell scripts can be used as Trojans to attack servers and obtain the execution permissions of the servers, causing great harm. At the same time, webshell scripts are usually short and hidden, and can be hidden in normal files. For example, for web pages that only allow uploading pictures, webshell script statements can be written into picture files. Therefore, webshell scripts are difficult to detect and have great harm.

[0048] In an illustrative embodiment of the present specification, the script to be detected includes a webshell script.

[0049] At the same time, webshell scripts can also be obfuscated and packed to resist security detection. Simple but effective obfuscation methods can usually be used in webshell scripts, such as deleting spaces and line breaks, code encryption, hexadecimal value obfuscation, and controllable input obfuscation. After obfuscation and packing, even if the security detection system locates the webshell script, it is difficult to determine whether the script is a harmless normal file or a script containing malicious behavior through text analysis.

[0050] After obtaining the script to be tested, the script to be tested may be run in a simulated running environment.

[0051] In an exemplary embodiment shown in this specification, the simulated operating environment includes an operating environment isolated from a real operating environment.

[0052] A sandbox is an operating environment isolated from a real operating environment. The operation of a program in a sandbox is strictly restricted. It can only access and control the simulated resources in the sandbox, but cannot directly access the system and hardware resources.

[0053] When the script runs in the simulated running environment, it will actively decrypt and unpack the statements to be run in order to run normally. Therefore, by dynamically detecting the running process and results of the script in the sandbox, the content of the statements actually run by the script can be obtained, so as to determine whether there is malicious behavior in the statements actually run by the above script in the sandbox.

[0054] However, since dynamic detection methods can usually be considered as simulations or previews of real script execution, the script may use adversarial methods that are difficult to detect accurately with dynamic detection, and the results of script execution may change with various complex conditions such as the running environment, time, and the number of script runs. For example, the script may contain branch confrontation, time confrontation, version confrontation, and other complex confrontation forms.

[0055] It is foreseeable that with the development of technology, the means of script adversarial detection will become more and more numerous and complex. Therefore, for more adversarial scripts, more targeted methods need to be used for detection.

[0056] The script detection method in this specification is applied to a security detection engine that uses an inference framework.

[0057] The above security detection engine can be used to detect scripts, and this specification does not limit the specific form of the above security detection engine. For example, the above security engine can be an independent detection server, can be deployed in a server or other form of computing device that receives or runs scripts, or can be deployed in a simulator or cloud device.

[0058] The security detection engine is preloaded with a reasoning strategy library; the reasoning strategy library contains a number of reasoning strategies for reasoning about the adversarial means used by the adversarial statements contained in the script to be detected for adversarial detection.

[0059] The script to be detected may be composed of several statements. Generally, a statement can be used as a unit when detecting the script to be detected. This specification does not limit the specific division method of the statements, and different methods can be used to divide the statements. For example, it can be divided by line, and one or more lines of code in the script are regarded as a statement; it can be divided by specific characters, such as using each semicolon ";" as the basis for dividing the statements; other methods of dividing statements can also be used.

[0060] Among them, some sentences may use adversarial means to counter the detection. Different sentences may use different adversarial means or the same adversarial means. A sentence may use only one adversarial means or multiple adversarial means.

[0061] The purpose of detecting a script to be detected is usually to determine whether the script has malicious behavior or may have malicious behavior by determining the operations performed by the script to be detected. The countermeasures against detection can usually confuse, deform, hide, etc. the operations performed by the script to hide the true intention of the script.

[0062] Therefore, the security detection engine in this specification adopts the method of reasoning analysis to counter the adversarial means of adversarial statements in the detection script, thereby restoring the true intention of the script.

[0063] The reasoning strategy can be used to perform corresponding reasoning on the adversarial means of the adversarial statements in the script to be detected, so as to identify the adversarial means adopted by the adversarial statements and the corresponding adversarial information; the above-mentioned adversarial information includes the specific implementation method of the adversarial means adopted by the adversarial statements, and based on the above-mentioned adversarial information, the adversarial statements that adopt the adversarial means can be corrected in response; executing the above-mentioned adversarial statements after correction can restore the operations that the adversarial statements actually want to perform, thereby achieving the purpose of detection.

[0064] Since the detection and reasoning of each statement in the script to be detected will consume corresponding resources, when detecting the script to be detected, we can first determine whether the target statement to be executed is a suspected adversarial statement that is suspected of using adversarial means, and only enable the reasoning strategy for statements that are suspected of using adversarial means.

[0065] For other statements in the script to be detected, simulation execution can be performed directly in the above simulation running environment.

[0066] If the target statement is a statement for operating a real resource, the real resource is simulated, for example, statements involving IO operations, database operations, network operations, thread creation, etc., which may implicitly transmit information or obtain logic of external resources in disguise.

[0067] For example, a script to be detected contains the following statement involving input operation: $a=$_GET['v1'];

[0068] This statement is written in PHP. It contains the $_GET[A] function, which is used to collect the value of parameter A in the form with method="get". The statement $a=$_GET['v1'] means assigning the value of the table item with key "v1" in the form with method="get" to the variable $b.

[0069] Therefore, a form with method="get" can be simulated in the above virtual running environment, which includes a table item with the key "v1", and the value of the table item is set to a preset value.

[0070] When the above statement is executed, the variable $a will be assigned the preset value.

[0071] This specification does not limit the specific method of determining whether the target statement to be executed is a suspected adversarial statement that is suspected of using adversarial means.

[0072] For example, detection can be performed by attempting to execute the target sentence, and the target sentence that cannot be executed normally can be determined as a suspected adversarial sentence;

[0073] The detection may also be performed by detecting the features of the target sentence to be executed, and determining the target sentence that meets the specific features as a suspected adversarial sentence;

[0074] The above features may include: containing specific keywords, matching specific expressions, and having a length exceeding a threshold, etc.

[0075] In an illustrative embodiment shown in the present specification, determining whether a target statement to be executed is a suspected adversarial statement for adversarial detection includes: detecting whether the target statement to be executed contains specific keywords; if so, determining that the target statement to be executed is a suspected adversarial statement.

[0076] For example, the above-mentioned specific keywords may include function names of dangerous functions that may have a higher risk in the PHP language, such as eval, include, create_function, system, exec, and the like.

[0077] Step 204: if the target sentence is a suspected adversarial sentence, execute the reasoning strategy in the reasoning strategy library to infer the adversarial means adopted by the target sentence, and obtain adversarial information for describing the adversarial means adopted by the target sentence;

[0078] After determining that the target sentence is a suspected adversarial sentence, the inference strategy in the inference strategy library can be executed. According to the different adversarial means adopted by the target sentence, different inference strategies are applicable to infer the adversarial means adopted by the target sentence, and obtain adversarial information used to describe the adversarial means adopted by the target sentence.

[0079] Possible adversarial methods used for the above target sentences include, but are not limited to:

[0080] Obfuscation confrontation, obfuscating at least part of the variables in the statements in the script to be detected to resist detection;

[0081] Version confrontation, in which the script to be detected contains statements written in multiple programming language types or versions to resist detection;

[0082] Hidden adversarial means introduce variables with uncertain values ​​into statements to counter detection.

[0083] The variables with uncertain values ​​may include but are not limited to:

[0084] By introducing external resources to control the value of variables, for example, variables $_GET[], $_POST[], etc.;

[0085] In a statement with a branching structure, variables have different values ​​in different statement branches;

[0086] Random variables, such as variables generated by the rand() function, and the timestamp function time() that generates a timestamp based on the current time, can also be considered a random variable because the results obtained at different times are different.

[0087] For adversarial means, corresponding reasoning strategies can be used for reasoning; for different adversarial means, different reasoning strategies can be used for reasoning; for the same adversarial rule, multiple reasoning strategies can be used for reasoning.

[0088] For example, Figure 3 As shown, Figure 3 is a schematic diagram of a script detection method in an implementation mode of this specification;

[0089] Figure 3 The script to be detected includes several adversarial statements and several normal statements, and the reasoning strategy library includes reasoning strategy A, reasoning strategy B, reasoning strategy C, reasoning strategy D, etc. Among them, reasoning strategy A can correspond to adversarial statement 1 and adversarial statement 2, reasoning strategy B can correspond to adversarial statement 3, and reasoning strategy C and reasoning strategy D can correspond to adversarial statement 4. Each of the above reasoning strategies can reason about the adversarial means adopted by the corresponding adversarial statement.

[0090] The above-mentioned confrontation information may be a specific implementation method of the above-mentioned confrontation means, for example, the transmission process information of variables in a certain dangerous function, including data source and transmission path, etc.

[0091] It should be noted that the script detection method in this specification does not rely on a specific reasoning strategy. The reasoning strategy can be targeted at the corresponding countermeasures. In actual use, the corresponding reasoning strategy can be adaptively pre-loaded according to the countermeasures that the script to be detected may adopt.

[0092] Step 206: correct the target sentence based on the adversarial information, execute the corrected target sentence, and further determine whether the target sentence is an adversarial sentence based on the execution result.

[0093] After the adversarial information is obtained through reasoning, corresponding corrections are made to the target sentence based on the adversarial information.

[0094] The correction is the process of removing the confrontation means from the sentence that adopts the confrontation means. The corrected sentence can more directly reflect the actual function that the sentence is to achieve. Depending on the confrontation means and the confrontation information corresponding to it, the corresponding correction method may also be different.

[0095] For example, the value of a variable with uncertain value is corrected to its possible value, and statements written in programming languages ​​of different language types or versions are transcribed into statements of preset language types and versions.

[0096] Since some adversarial statements may use multiple anti-countermeasures, the corrected adversarial statement may still be a suspected adversarial statement. If it is still a suspected adversarial statement, continue to execute the reasoning strategy in the above reasoning library, continue to reason and correct until the corrected adversarial statement is no longer a suspected adversarial statement.

[0097] After the target sentence is corrected, the corrected target sentence can be executed, and based on the execution result, it can be further determined whether the target sentence is an adversarial sentence.

[0098] Depending on the different adversarial means used for the target sentence, the execution result corresponding to the corrected target sentence that can determine that the target sentence is an adversarial sentence may also be different.

[0099] For example, when the confrontation method used by the target statement is version confrontation, the execution result corresponding to the corrected target statement may be that the target statement can be executed normally.

[0100] For another example, when the execution result corresponding to the corrected target statement can clearly indicate that the target statement contains malicious behavior or can cause malicious behavior, the target statement can be determined to be an adversarial statement.

[0101] In an illustrative embodiment shown in the present specification, the further determining whether the target statement is an adversarial statement based on the execution result includes: determining whether the corrected target statement is successfully executed based on the execution result; if the corrected target statement is successfully executed, determining that the target statement is an adversarial statement.

[0102] For the partially corrected target statement, it is difficult to determine whether the statement is an adversarial statement based only on its execution result. We can perform context semantic analysis based on the statements related to the target statement, and based on the results of the context semantic analysis, we can further determine whether the target statement may contain malicious behavior and whether the target statement may be an adversarial statement.

[0103] The above context semantics include the operation of each node in the context, such as assignment, calculation and other operations; and the call of each function in the context, such as ordinary functions, class functions, closure functions, etc.; the semantics of the above context are embedded with decision-making units for semantic analysis and judgment.

[0104] The above-mentioned security detection engine includes an API interface for flexibly configuring the above-mentioned decision-making unit, so as to facilitate relevant management personnel to configure the decision-making unit by writing and importing Lua API.

[0105] The above decision unit can record the value status of each variable in the context in detail, including:

[0106] The state of the variable, such as the assigned state, the polluted state, etc.; the polluted state includes the above-mentioned function being assigned an uncertain value, for example, a variable assigned by a function that may implicitly transmit information or obtain external resources in disguised form can be considered to be in a polluted state, and a variable in a polluted state can be called a taint;

[0107] Taint source information, which may include the location and cause of the taint state;

[0108] The taint transfer path may include a path for the taint state to be transferred from the taint source to the above context, including a path for transferring between different statements and functions;

[0109] Confidence, which can include the degree of confidence in the tainted state of the variable;

[0110] Since each value in the statement records the above detailed information, the decision unit can make an accurate judgment on whether the target statement is an adversarial statement based on the context semantics and detailed information of the values ​​of the above variables, which can effectively reduce missed reports or false positives.

[0111] In an exemplary embodiment shown in this specification, determining that the target sentence is an adversarial sentence includes:

[0112] Performing contextual semantic analysis on the target sentence and sentences related to the target sentence, and further calculating a credibility score of the target sentence as an adversarial sentence based on the result of the contextual semantic analysis; determining whether the credibility score reaches a threshold; and if so, determining whether the target sentence is an adversarial sentence.

[0113] The script detection method described above is described in detail below in conjunction with several embodiments of reasoning strategies for specific adversarial means.

[0114] In an exemplary embodiment shown in this specification, the script to be detected includes an adversarial statement using an adversarial means of obfuscation adversarial; wherein the obfuscation adversarial means refers to an adversarial means of obfuscating at least part of the variables in the statement in the script to be detected to resist detection;

[0115] The obfuscation of variables may include passing the value of the variable, such as passing it in a database, file, etc., pointing the variable to an undefined variable, and other obfuscation operations, which usually involve external resources, making it difficult for the security detection engine to determine the value of the obfuscated variable by direct simulation, and thus difficult to judge whether it is safe.

[0116] The inference strategy library includes inference strategies corresponding to the obfuscation confrontation; according to the above inference strategies, the variables to be obfuscated in the target sentence can be inferred; the inference strategy can infer the possible transmission path of the variables to be obfuscated in the target sentence based on the target sentence and related sentences in the context.

[0117] Based on the results of the above reasoning, the obfuscated variables in the target sentence can be corrected and restored.

[0118] For example, in a PHP script, there is a statement that uses the following obfuscation countermeasures:

[0119] $a = "system"; / / Statement S11

[0120] file_put_contents(" / tmp / ".basename($_GET['filename']),$a); / / Statement S12

[0121] $b = file_get_contents(" / tmp / 1.txt"); / / Statement S13

[0122] $b($_GET['cmd']); / / Statement S14

[0123] The meaning of the following statements are:

[0124] Statement S11, "$a = "system";" means: assign variable $a to the string system;

[0125] Statement S12, "file_put_contents(" / tmp / ".basename($_GET['filename']),$a);" means: write the value of variable $a to the file with the path name filename in the directory / tmp, where filename can be a parameter introduced from outside;

[0126] The function of statement S13, "$b = file_get_contents(" / tmp / 1.txt");" is: assign the variable $b to the content of the file 1.txt in the / tmp directory;

[0127] Statement S14, “$b($_GET['cmd']);” means function $b, parameter cmd, where cmd can be a parameter introduced from outside.

[0128] For the above statements, first, in statement S4, there is a non-standard function variable $b, and the parameter of the function is a function variable $_GET that introduces an external parameter. Statement S3 that assigns a value to variable $b references the content of the unknown file 1.txt that has not been declared. In traditional dynamic detection, since it is impossible to confirm the content of the unknown file 1.txt, it is impossible to confirm whether function b is a dangerous function.

[0129] In the inference-based security detection system of this specification, the inference strategy for the above-mentioned obfuscation confrontation means can be based on the behavior of writing files in the directory / tmp in the above statement S12, and the relationship between the above-mentioned filename file and 1.txt can be inferred, and the file with the path name filename in the above statement $12 is 1.txt;

[0130] At this point, a connection is established between the above statements S11, S12 and statements S13, S14. Statement S12 writes the string system into the above file 1.txt, and statement S13 assigns it to the variable $b. Finally, based on the above information, statement S14 can be corrected to "system($_GET['cmd'])".

[0131] The “system($_GET['cmd'])” is a very dangerous statement that can run any content passed in from the outside. It is a typical webshell malicious script.

[0132] In the above embodiment, the above inference strategy can infer the value of the undefined variable, so as to correct and restore the obfuscated variable $b. The restored statement "system($_GET['cmd'])" can be clearly identified as a very dangerous malicious statement, so that the security detection engine can make an accurate judgment.

[0133] In an illustrative embodiment shown in the present specification, the script to be detected includes an adversarial statement that adopts a hidden adversarial means; wherein, the hidden adversarial means refers to introducing variables with uncertain values ​​in the statement to resist the adversarial means of detection; the above-mentioned variables with uncertain values ​​include: variables whose values ​​are controlled by introducing external resources, random variables, variables with different values ​​in the running results of different branch statements of the branch structure, etc.

[0134] When there are variables with uncertain values ​​in a statement, traditional dynamic detection methods are usually unable to detect them accurately. They can only randomly assign them a specific value. Obviously, such methods are extremely unreliable and are likely to fail to detect possible malicious behavior, resulting in missed reports. However, if statements containing variables with uncertain values ​​are directly identified as malicious behavior, a large number of false positives will be caused. Therefore, traditional dynamic detection methods cannot accurately detect statements with variables with uncertain values.

[0135] The inference strategy library includes inference strategies corresponding to hidden adversarial methods; according to the above inference strategies, the inferred values ​​of the variables with uncertain values ​​contained in the target statement can be inferred; based on the results of the above inference, the values ​​of the variables with uncertain values ​​contained in the target statement can be corrected to the above inferred values.

[0136] The above-mentioned reasoning strategy corresponding to hidden confrontation can infer the inferred value of the above-mentioned variable with uncertain value, or convert the above-mentioned variable with uncertain value into a variable with certain value based on the above-mentioned statement containing the variable with uncertain value and the related statements in the context.

[0137] For example, the time() function is used to obtain the value of the timestamp corresponding to the current date and time. As time goes by, the current value of the timestamp increases by 1 per second; therefore, its value varies with the running time, and it can be regarded as a random variable, which is a variable with uncertain value. However, in some cases, the script may use the operation of the timestamp value to convert it into a variable with a certain value. However, since the timestamp function itself is a variable with an uncertain value, it is impossible to confirm that it can be converted into the above-mentioned variable with a certain value every time it runs during dynamic detection, and it is impossible to make a correct judgment.

[0138] For example, in a certain PHP script, there is a statement that uses the following hidden countermeasures including a timestamp function:

[0139] $a=time(); / / S21

[0140] sleep(60*5); / / S22

[0141] $b=time(); / / S23

[0142] $index=$b-$a / / S24

[0143] The meanings of the statements are as follows: statement S21 means assigning the value of the current timestamp to variable $a; statement S22 means sleeping for 5 minutes and then continuing execution after 5 minutes; statement S23 means assigning the value of the current timestamp to variable $b; statement S24 means assigning the difference between variable $b and variable $a to variable $index.

[0144] Usually, since the two variables $b and $a that determine the value of the variable $index are both timestamp variables with uncertain values, the variable $index will also be marked as a variable with uncertain values, and its value cannot be accurately determined.

[0145] According to the above reasoning strategy, we can find the difference between the two timestamp functions and the sleep function with a fixed length between the two timestamps, thereby inferring that the value of the variable $index is a fixed value of 300.

[0146] Based on the above reasoning, the above statement S24 can be corrected to $index=300.

[0147] In an illustrative embodiment shown in this specification, the above hidden confrontation includes branch confrontation, and the statement in the above script to be detected includes multiple statement branches. The branch confrontation refers to the confrontation means of countering detection by introducing multiple statement branches so that after the execution of the above multiple statement branches, the value of the target variable contained in the statement is uncertain; the reasoning strategy corresponding to the branch confrontation includes a sub-rule for recording the change of the target variable after the execution of the above multiple statement branches.

[0148] The above statement branches may include branch structures and loop structures. In scripts, branch structures and loop structures are common logical structures. Taking the branch structure as an example, the branch structure may include a conditional statement and at least one statement branch corresponding to the conditional statement. Different running results of the conditional statement correspond to different statement branches.

[0149] When the script logic structure contains the branch structure as described above, when the script is run in the sandbox, only some of the branch statements will actually run. Therefore, dynamic detection of the script can only detect whether the branch statements that are actually run have malicious behavior, but cannot detect the branch statements that are not actually run.

[0150] By using the above characteristics of the branch structure, the script can deliberately write malicious behavior into the branch statement, and through various means, when the script is running in the sandbox, the branch statement containing malicious behavior will not be actually executed. For example, by setting the conditional statement corresponding to the branch statement containing malicious behavior to be related to the virtual running environment, it can be determined whether the script is running in the virtual running environment; if it is detected that the script is running in the virtual environment, it will not enter the branch containing malicious behavior, thereby achieving the purpose of evading security detection.

[0151] In addition, after different statement branches in the branch structure are executed, the value of the target variable contained in the above statement may be uncertain. For example, different statement branches perform different operations or assignments on the above target variable. Then, after the branch structure is executed, the value of the target variable will become uncertain.

[0152] For example, in a PHP script, there is a statement that uses branching countermeasures as follows:

[0153] if($_GET["v1"] == 0) / / S31

[0154] {$b=100; / / S32

[0155] }else{$b=$_GET["v2"];} / / S33

[0156] $c=$b / / S34

[0157] The meaning of the above statements is, statement S31: if the value of the parameter v1 that can be introduced from the outside is 0, then assign the variable $b to 100; statement S32: otherwise assign the variable $b to the value of the parameter v2 that can be introduced from the outside; statement S33: assign the value of the variable $b to the variable $c.

[0158] In the above branch statements, since the value of v1 cannot be determined, the value of variable $b in statement S34 is uncertain, and accordingly, the value of variable $c cannot be determined either.

[0159] According to the reasoning strategy corresponding to the branch confrontation, a sub-rule for recording the change of the target variable after executing the above multiple statement branches respectively can be included. For example, in the above example, according to the reasoning strategy, two possible inferred values ​​of the variable $b can be recorded respectively: 100 and v2. And the statement S34 is corrected to two possible situations of $c=100 and $c=$_GET["v2"], and when the script subsequently references the variable $c, the above two possible inferred values ​​are used for execution and detection respectively.

[0160] The above-mentioned reasoning strategy against branch induction can record various inference information of a variable, including value and state, etc., so as to solve the branch bypass problem in the script to be detected.

[0161] In an illustrative embodiment of the present specification, the script to be detected includes a confrontation statement using a confrontation method of version confrontation; wherein, version confrontation refers to the confrontation method of including statements written in multiple programming language types or versions in the script to be detected to counter the detection;

[0162] The inference strategy library includes inference strategies corresponding to the above version confrontation; the inference strategy can infer the type and version information of the programming language used by the statements in the script to be detected, and correct the statements in the above script to use the preset programming language type or version.

[0163] The method for obtaining the type and version information of the programming language used in the above-mentioned reasoning strategy reasoning statement can be achieved by detecting a specific format and specific keywords in the statement, by trying to run a trial run according to different programming language types and versions, or by other methods, and this specification does not specifically limit this.

[0164] Step 208: In response to the user's call to the update interface, update the reasoning strategy library.

[0165] The security detection engine opens an update interface for the inference strategy library to the user; therefore, the inference strategies in the inference strategy library can be updated by calling the update interface.

[0166] Since the script detection method using the reasoning framework in this specification does not rely on any specific reasoning strategy, the reasoning strategies in the reasoning strategy library can be adaptively added, deleted, modified, replaced, etc. according to actual needs.

[0167] The confrontation between security detection systems and malicious scripts is increasing with the development of both technologies. The confrontation methods used by scripts will continue to change and upgrade. In response, in order to detect the newer and more covert confrontation methods used by scripts, the security detection system is also required to update the corresponding reasoning strategy for the new confrontation methods.

[0168] like Figure 4 As shown, Figure 4 It is a schematic diagram of the reasoning architecture of a script detection method shown in this specification.

[0169] Figure 4The diagram shows the reasoning framework in the security detection engine in this specification. The security detection engine can be deployed in various devices such as public cloud, private cloud, end engine, etc., and supports multiple scripting languages ​​such as PHP, JSP, ASP, Shell, Python, etc.

[0170] Since the reasoning strategy can be flexibly adjusted, the adversarial performance of the script detection method using the reasoning framework in this specification can also be continuously improved.

[0171] In order to implement each reasoning strategy in the reasoning strategy library, the virtual operating environment adopted by the security detection engine based on the reasoning framework in this specification can be specially made based on the reasoning framework.

[0172] The basic support layer of the security detection engine includes general AST parsing, process-level system simulation, DAU decision-making unit, standard third-party libraries such as Json, XML, MD5, etc., and standard virtual machines such as php Zend, java VM, etc.

[0173] In an exemplary implementation shown in this specification, the reasoning framework includes a reasoning framework based on a universal AST (Abstract Syntax Tree) that supports multiple types and versions of languages.

[0174] AST is a tree structure that can easily analyze the logical structure of the script code and perform corresponding semantic analysis.

[0175] Universal AST parsing can support a variety of different language types and versions, such as PHP, Java, JSP, etc., and parse the source code of the script to be tested into a universal AST.

[0176] Through the universal AST parsing, a unified expression method can be used in multiple scripting languages, thereby shielding the writing differences at the language level, thereby realizing a unified AI model, Yara regular expressions, cross-language simulation environment, etc.

[0177] Process-level system simulation, by abstracting platform capabilities such as IO system, network, process, thread, environment variables, database system, etc. into a lightweight simulation layer, process-level system simulation can create an independent simulation environment for each script to be tested, which can not only allow the sample to complete system-level operations normally, but also effectively solve the risk of sample escape.

[0178] The decision unit can effectively balance the false positives and omissions of the security detection engine by embedding each value in each process and supporting flexible configuration.

[0179] In addition to integrating standard virtual machines and standard third-party libraries, some special functions can be reconstructed. For example, dangerous functions such as eval function, include function, create_function function, system function, and exec function can be rewritten and specially processed to ensure that they will not cause irreversible impact on the system during operation, thereby ensuring safety. Another example is combining functions that operate on actual resources such as IO systems, networks, and databases with process-level system simulation capabilities to achieve resource simulation.

[0180] The above reasoning architecture may include a runtime simulation layer, a syntax simulation layer, and a reasoning correction layer. The reasoning correction layer includes a reasoning strategy library and various reasoning strategies therein, such as variable scope pollution strategy, conditional expression profile pollution strategy, uncertain value reasoning strategy, uncalled function discovery processing strategy, IO indirect transfer heuristic strategy, etc.; the reasoning strategies therein may be updated according to actual needs.

[0181] The runtime simulation layer and the syntax simulation layer, as well as the reconstructed special functions mentioned above, are the specific implementations of the above-mentioned reasoning strategies. Depending on the different reasoning strategies that need to be implemented, there may also be corresponding different implementations.

[0182] In an exemplary embodiment of the present specification, a script detection device is also provided. Figure 5 , Figure 5 It is a block diagram of a script detection device according to an embodiment of the present specification.

[0183] The device includes the following units:

[0184] The detection unit 510 is used to determine whether the target statement to be executed is a suspected adversarial statement during the process of running each statement included in the script to be detected in the simulation running environment;

[0185] The reasoning unit 520 is used to execute the reasoning strategy in the reasoning strategy library when determining that the target sentence is a suspected adversarial sentence, to infer the adversarial means adopted by the target sentence, and to obtain adversarial information for describing the adversarial means adopted by the target sentence;

[0186] The correction unit 530 is used to correct the target sentence based on the adversarial information, execute the corrected target sentence, and further determine whether the target sentence is an adversarial sentence based on the execution result.

[0187] Optionally, the security detection engine opens an update interface for the reasoning strategy library to the user; the device further includes:

[0188] The updating unit 540 is configured to update the inference strategy library in response to a user calling the updating interface.

[0189] Optionally, the detection unit 510 is specifically configured to detect whether the target sentence to be executed contains specific keywords;

[0190] If so, it is determined that the target sentence to be executed is a suspected adversarial sentence.

[0191] Optionally, the correction unit 530 is specifically configured to determine whether the corrected target statement is successfully executed based on the execution result; if the corrected target statement is successfully executed, determine that the target statement is an adversarial statement.

[0192] Optionally, the correction unit 530 is specifically used to perform contextual semantic analysis on the target sentence and sentences related to the target sentence, and further calculate the credibility score of the target sentence as an adversarial sentence based on the result of the contextual semantic analysis; determine whether the credibility score reaches a threshold; if so, determine whether the target sentence is an adversarial sentence.

[0193] Optionally, the script to be detected includes an adversarial statement using an adversarial means of obfuscation adversarial;

[0194] The inference strategy library includes inference strategies corresponding to the obfuscation confrontation; wherein the obfuscation confrontation refers to a confrontation method of obfuscating at least part of the variables in the statements in the script to be detected to resist detection;

[0195] Correspondingly, the inference unit 520 is specifically used to infer the obfuscated variables in the target sentence;

[0196] Correspondingly, the correction unit 530 is specifically used to correct and restore the obfuscated variables in the target sentence.

[0197] Optionally, the script to be detected includes a confrontation statement using a hidden confrontation approach;

[0198] The inference strategy library includes inference strategies corresponding to the hidden confrontation; wherein the hidden confrontation refers to a confrontation method of introducing a variable with uncertain value into a statement to counter the detection;

[0199] Correspondingly, the inference unit 520 is specifically used to infer the inferred value of the variable with uncertain value contained in the target sentence;

[0200] Correspondingly, the correction unit 530 is specifically configured to correct the value of the variable with uncertain value contained in the target statement to the inferred value.

[0201] Optionally, the target sentence includes multiple sentence branches; the hidden confrontation includes branch confrontation;

[0202] The inference strategy library includes inference strategies corresponding to the branch confrontation; wherein the branch confrontation refers to introducing multiple statement branches in the statement so that after the multiple statement branches are executed, the value of the target variable contained in the statement is uncertain, so as to resist the detection confrontation means; the inference strategy corresponding to the branch confrontation includes a sub-rule for recording the change of the target variable after the multiple statement branches are respectively executed;

[0203] Correspondingly, the inference unit 520 is specifically used to infer the respective inferred values ​​corresponding to the target variables after the execution of the multiple statement branches;

[0204] Correspondingly, the correction unit 530 is specifically used to correct the value of the target variable to the various inferred values ​​in sequence.

[0205] Optionally, the variable with uncertain value includes one or more of the following: a variable whose value is controlled by introducing external resources, and a random variable.

[0206] Optionally, the script to be detected includes a confrontation statement using a confrontation method of version confrontation;

[0207] The inference strategy library includes inference strategies corresponding to the version confrontation; wherein the version confrontation refers to a confrontation method of including statements written in multiple programming language types or versions in the script to be detected to resist detection;

[0208] Correspondingly, the reasoning unit 520 is specifically used to infer the type or version of the programming language used by the target statement;

[0209] Correspondingly, the correction unit 530 is specifically configured to correct the target statement into a statement using a preset programming language type or version.

[0210] Optionally, the simulated operating environment includes an operating environment isolated from the real operating environment.

[0211] Optionally, the script to be detected includes a webshell script.

[0212] Optionally, the reasoning framework includes a reasoning framework based on a universal AST that supports multiple types and versions of languages.

[0213] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0214] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on at least one network unit. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this specification. Ordinary technicians in this field can understand and implement it without paying creative work.

[0215] In an exemplary embodiment of the present specification, an embodiment of a device and a terminal to which the device is applied is also provided.

[0216] The embodiments of the device of this specification can be applied to computer devices, such as servers or terminal devices. The device embodiments can be implemented by software, hardware, or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor in which it is located reading the corresponding computer program instructions in the non-volatile memory into the memory and running them. From the hardware level, if Figure 6 As shown, Figure 6 A hardware structure diagram of a computer device 60 in which a device of an embodiment of this specification is located, except Figure 6 In addition to the processor 610, memory 630, network interface 620, and non-volatile memory 640 shown, the server or electronic device where the device is located in the embodiment may also include other hardware according to the actual function of the computer device, which will not be described in detail.

[0217] In the exemplary embodiments of this specification, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of this specification is stored. In some possible embodiments, various aspects of this specification can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of this specification described in the above "Exemplary Method" section of this specification.

[0218] According to the embodiment of the present specification, the program product for implementing the above method can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present specification is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0219] The program product may adopt any combination of one or at least one readable medium. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or at least one wire, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0220] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0221] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0222] Program code for performing the operations of the present specification may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0223] Although this specification contains many specific implementation details, these should not be interpreted as limiting the scope of any invention or the scope of the claimed protection, but are mainly used to describe the features of the specific embodiments of specific inventions. Certain features described in at least one embodiment in this specification may also be implemented in combination in a single embodiment. On the other hand, the various features described in a single embodiment may also be implemented separately in at least one embodiment or in any suitable sub-combination. In addition, although the features may work in certain combinations as described above and even initially claim protection, one or at least one feature from the claimed combination may be removed from the combination in some cases, and the claimed combination may point to a sub-combination or a variation of a sub-combination.

[0224] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring these operations to be performed in the particular order shown or to be performed sequentially, or requiring all illustrated operations to be performed to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system units and components in the above-described embodiments should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product, or packaged into at least one software product.

[0225] Thus, specific embodiments of the subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In some implementations, multitasking and parallel processing may be advantageous.

[0226] The above description is only a preferred embodiment of this specification and is not intended to limit this specification. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this specification should be included in the scope of protection of this specification.

Claims

1. A script detection method, applied to a security detection engine using an inference framework, characterized in that: The security detection engine is preloaded with a reasoning strategy library; the reasoning strategy library contains several reasoning strategies for reasoning about the confrontation means used by the confrontation statements for confrontation detection contained in the script to be detected; the method includes: In the process of running each statement included in the script to be detected in the simulation running environment, determining whether the target statement to be executed is a suspected adversarial statement; wherein the suspected adversarial statement includes a statement suspected of using adversarial means for security detection; If the target sentence is a suspected adversarial sentence, executing the reasoning strategy in the reasoning strategy library to infer the adversarial means adopted by the target sentence, and obtaining adversarial information for describing the adversarial means adopted by the target sentence; The target sentence is corrected based on the adversarial information, and the corrected target sentence is executed, and whether the target sentence is an adversarial sentence is further determined based on the execution result.

2. The method according to claim 1, characterized in that The security detection engine opens an update interface for the reasoning strategy library to users; The method further comprises: In response to a user calling the update interface, the reasoning strategy library is updated.

3. The method according to claim 1, characterized in that The step of determining whether the target statement to be executed is a suspected adversarial statement for adversarial detection includes: Detecting whether the target sentence to be executed contains specific keywords; If so, it is determined that the target sentence to be executed is a suspected adversarial sentence.

4. The method according to claim 1, characterized in that The further determining whether the target sentence is an adversarial sentence based on the execution result includes: Determining whether the corrected target statement is successfully executed based on the execution result; If the corrected target sentence is executed successfully, the target sentence is determined to be an adversarial sentence.

5. The method according to claim 4, characterized in that Determining that the target sentence is an adversarial sentence includes: Performing contextual semantic analysis on the target sentence and sentences related to the target sentence, and further calculating a credibility score of the target sentence as an adversarial sentence based on the result of the contextual semantic analysis; determining whether the credibility score reaches a threshold; and if so, determining whether the target sentence is an adversarial sentence.

6. The method according to claim 1, characterized in that The script to be detected includes an adversarial statement using an adversarial means of obfuscation adversarial; The inference strategy library includes inference strategies corresponding to the obfuscation confrontation; wherein the obfuscation confrontation refers to a confrontation method of obfuscating at least part of the variables in the statements in the script to be detected to resist detection; The executing the reasoning strategy in the reasoning strategy library, reasoning the confrontation means adopted by the target sentence, and obtaining confrontation information for describing the confrontation means adopted by the target sentence includes: Reasoning about obfuscated variables in the target sentence; The correcting the target sentence based on the adversarial information includes: Correct and restore the obfuscated variables in the target sentence.

7. The method according to claim 1, characterized in that The script to be detected includes a confrontation statement using a hidden confrontation method; The inference strategy library includes inference strategies corresponding to the hidden confrontation; wherein the hidden confrontation refers to a confrontation method of introducing a variable with uncertain value into a statement to counter the detection; The executing the reasoning strategy in the reasoning strategy library, reasoning the confrontation means adopted by the target sentence, and obtaining confrontation information for describing the confrontation means adopted by the target sentence includes: Reasoning about the inferred value of a variable with uncertain value contained in the target statement; The correcting the target sentence based on the adversarial information includes: The value of the variable with uncertain value contained in the target statement is corrected to the inferred value.

8. The method according to claim 7, characterized in that The target sentence includes a plurality of sentence branches; the hidden confrontation includes branch confrontation; The inference strategy library includes inference strategies corresponding to the branch confrontation; wherein the branch confrontation refers to introducing multiple statement branches in the statement so that after the multiple statement branches are executed, the value of the target variable contained in the statement is uncertain, so as to resist the detection confrontation means; the inference strategy corresponding to the branch confrontation includes a sub-rule for recording the change of the target variable after the multiple statement branches are respectively executed; The inferring of the inferred value of the variable with uncertain value contained in the target statement includes: After the execution of the multiple statement branches, the inferred values ​​corresponding to the target variables are respectively inferred; The correcting the target sentence based on the adversarial information includes: The value of the target variable is corrected to each of the inferred values ​​in sequence.

9. The method according to claim 7, characterized in that: The variables with uncertain values ​​include one or more of the following: By introducing external resources to control the value of variables, random variable.

10. The method according to claim 1, characterized in that The script to be detected includes a confrontation statement using a confrontation method of version confrontation; The inference strategy library includes inference strategies corresponding to the version confrontation; wherein the version confrontation refers to a confrontation method of including statements written in multiple programming language types or versions in the script to be detected to resist detection; The executing the reasoning strategy in the reasoning strategy library, reasoning the confrontation means adopted by the target sentence, and obtaining confrontation information for describing the confrontation means adopted by the target sentence includes: Reasoning about the type or version of the programming language used by the target statement; The correcting the target sentence based on the adversarial information includes: The target statement is corrected to be a statement using a preset programming language type or version.

11. The method according to claim 1, characterized in that: The simulated operating environment includes an operating environment isolated from the real operating environment.

12. A script detection device, applied to a security detection engine using an inference framework, characterized in that: The security detection engine is preloaded with a reasoning strategy library; the reasoning strategy library contains several reasoning strategies for reasoning about the confrontation means used by the confrontation statements for confrontation detection contained in the script to be detected; the device includes: A detection unit, used to determine whether a target statement to be executed is a suspected adversarial statement during the process of running each statement included in the script to be detected in the simulated running environment; wherein the suspected adversarial statement includes a statement suspected of using adversarial means for security detection; An inference unit, configured to execute the inference strategy in the inference strategy library when determining that the target sentence is a suspected adversarial sentence, infer the adversarial means adopted by the target sentence, and obtain adversarial information for describing the adversarial means adopted by the target sentence; A correction unit is used to correct the target sentence based on the adversarial information, execute the corrected target sentence, and further determine whether the target sentence is an adversarial sentence based on the execution result.

13. A storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, the steps of the method according to any one of claims 1 to 11 are implemented.

14. A computer device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the following method is implemented: wherein when the processor executes the program, the method as claimed in any one of claims 1 to 11 is implemented.

Images