Method and device for automatically mining vulnerabilities of embedded device based on Linux system

Abstract

The application provides a Linux system-based embedded device vulnerability automatic mining method and device, which comprises the following steps: obtaining a Linux file system; processing the Linux file system to determine boundary binaries and reference strings for analyzing command injection and buffer overflow, wherein the boundary binaries comprise executable binaries directly participating in processing user data or indirectly participating in processing user data, and the reference strings comprise reference strings for locating the starting position of control flow analysis; exploring paths in a dynamic link library according to the reference strings and the boundary binaries to determine dangerous paths, wherein the dangerous paths comprise paths for calling dangerous functions. Since the application also focuses on the dynamic link library in the Linux-based embedded device, command execution and buffer overflow vulnerabilities in the Linux-based embedded device can be found.

Description

TECHNICAL FIELD

[0001] The present application relates to vulnerability mining of Linux system, in particular to a vulnerability automatic mining method and device for embedded devices based on Linux system. BACKGROUND

[0002] With the expansion of the Internet of Things industry and the popularity of intelligent devices, hundreds of millions of embedded devices based on Linux system gradually integrate into people's lives. However, the huge number, multiple types and weak computing power of embedded devices are very easy to have various security vulnerabilities, and these security vulnerabilities will cause serious losses once maliciously used by attackers.

[0003] Compared with traditional personal computers, embedded devices based on Linux have the characteristics of limited hardware resources, complex running environment, multiple processor architectures and frequent inter-process communication, which makes the traditional vulnerability mining tools unable to be directly applied to embedded devices based on Linux system.

[0004] Therefore, the prior art cannot find command execution and buffer overflow vulnerabilities in embedded devices based on Linux. SUMMARY

[0005] In view of the problems in the prior art, the present application provides a vulnerability automatic mining method and device for embedded devices based on Linux system, which can efficiently and quickly find security vulnerabilities in embedded devices based on Linux.

[0006] The present application is realized by the following technical solutions:

[0007] In one aspect, the present application provides a vulnerability automatic mining method for embedded devices based on Linux system, comprising:

[0008] obtaining a Linux file system;

[0009] processing the Linux file system to determine boundary binaries and reference strings for analyzing command injection and buffer overflow, the boundary binaries including executable binaries directly participating in processing user data or indirectly participating in processing user data, and the reference strings including reference strings for locating the starting position of control flow analysis.

[0010] exploring paths in dynamic link libraries according to the reference strings and the boundary binaries to determine dangerous paths, the dangerous paths including paths calling dangerous functions.

[0011]

[0012] ​Further, the processing the Linux file system to determine the reference string and the boundary binary includes:

[0013] obtaining a front reference string and a preset boundary binary;

[0014] determining a parameter string corresponding to an inter-process communication write function according to the preset boundary binary;

[0015] determining whether an inter-process communication read function references the parameter string, the inter-process communication read function being a read function corresponding to the inter-process communication write function;

[0016] if yes, determining that the parameter string is the reference string and the preset boundary binary is a boundary binary.

[0017] Further, the exploring the path in the dynamic link library according to the reference string and the boundary binary to determine a dangerous path includes:

[0018] exploring the path in the boundary binary to determine a path of a dangerous function and a path of an external function;

[0019] obtaining a dynamic link library corresponding to the external function according to the external function, and determining a path of calling a dangerous function in the dynamic link library;

[0020] taking the path as the dangerous path.

[0021] Further, the exploring the path in the dynamic link library according to the reference string and the boundary binary to determine the path of calling the dangerous function further includes:

[0022] processing the boundary binary and the dynamic link library respectively to determine an invalid path in the dangerous path.

[0023] Further, the obtaining the Linux file system further includes:

[0024] determining a Linux startup script according to the Linux file system;

[0025] regularly and line by line interpreting the Linux startup script to determine a Shell call tree, the Shell call tree including taking a program, a function and a script name as a tree node;

[0026] traversing the Shell call tree to determine a self-starting program list;

[0027] determining that a self-starting program exists abnormally according to the self-starting program list;

[0028] If yes, the self-starting program is a backdoor program;

[0029] If no, the self-starting program is not a backdoor program.

[0030] In one aspect, an embodiment of the present application provides an embedded device vulnerability automatic mining device based on a Linux system, comprising:

[0031] An acquisition module, configured to acquire a Linux file system;

[0032] A processing module, configured to process the Linux file system, determine boundary binaries and reference strings for analyzing command injection and buffer overflow, wherein the boundary binaries comprise executable binaries directly or indirectly participating in processing user data, and the reference strings comprise reference strings for locating a control flow analysis starting point position;

[0033] A determination module, configured to explore paths in a dynamic link library according to the reference strings and the boundary binaries, and determine a dangerous path, wherein the dangerous path comprises a path of calling a dangerous function.

[0034] Further, the processing module is specifically configured to acquire a front-end reference string and a preset boundary binary, determine a parameter string corresponding to an inter-process communication write function according to the preset boundary binary, and determine whether an inter-process communication read function references the parameter string, wherein the inter-process communication read function is a read function corresponding to the inter-process communication write function; if yes, the parameter string is determined as the reference string, and the preset boundary binary is determined as a boundary binary.

[0035] Further, the determination module is specifically configured to perform path exploration on the boundary binary, determine a path of a dangerous function and a path of an external function, acquire a dynamic link library corresponding to the external function according to the external function, and determine a path of calling a dangerous function in the dynamic link library; and the path is used as the dangerous path.

[0036] Further, the determination module is further configured to process the boundary binary and the dynamic link library respectively, and determine an invalid path in the dangerous path.

[0037] Further, the processing module is further used for determining a Linux startup script according to the Linux file system; performing regular line-by-line interpretation on the Linux startup script to determine a Shell call tree, the Shell call tree including programs, functions, script names as tree nodes; traversing the Shell call tree to determine a self-starting program list; determining that the self-starting program is abnormal according to the self-starting program list; if yes, the self-starting program is a backdoor program; and if no, the self-starting program is not a backdoor program.

[0038] Compared with the prior art, the present application has the following beneficial technical effects:

[0039] The Linux system-based embedded device vulnerability automatic mining method and device provided by the embodiment of the present application obtain a Linux file system; process the Linux file system to determine boundary binaries and reference strings for analyzing command injection and buffer overflow, the boundary binaries including executable binaries directly participating in processing user data or executable binaries indirectly participating in processing user data, and the reference strings including reference strings for locating a control flow analysis starting point position; explore paths in a dynamic link library according to the reference strings and the boundary binaries to determine dangerous paths, the dangerous paths including paths for calling dangerous functions. Since the present application also focuses on dynamic link libraries in Linux-based embedded devices, command execution and buffer overflow vulnerabilities in Linux-based embedded devices can be found. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 is a flowchart of the Linux system-based embedded device vulnerability automatic mining method according to an embodiment of the present application;

[0041] Figure 2 is a schematic diagram of an unsafe path according to an embodiment of the present application;

[0042] Figure 3 is a schematic diagram of a boundary binary pollution convergence point according to an embodiment of the present application;

[0043] Figure 4 is a schematic diagram of execution time comparison according to an embodiment of the present application;

[0044] Figure 5 is a structural schematic diagram of the Linux system-based embedded device vulnerability automatic mining device according to an embodiment of the present application. DETAILED DESCRIPTION

[0045] The present application will be further described in detail below in combination with specific embodiments, which are an explanation of the present application rather than a limitation.

[0046] As Figure 1 shown, the embodiment of the application provides a Linux system-based embedded device vulnerability automatic mining method, comprising:

[0047] Step 1, obtaining a Linux file system;

[0048] For example, the automatic decompression of firmware and file recognition and classification. First, according to the type of firmware, use ZIP, Binwalk and other tools for recursive decompression to obtain the complete Linux file system. Then, classify the files of the entire embedded system, extract the Shell script, front-end static file (including HTML, JS, XML), back-end executable binary and shared dynamic link library.

[0049] Step 2, processing the Linux file system to determine the boundary binary and reference string for analyzing command injection and buffer overflow.

[0050] The boundary binary in this embodiment includes executable binaries that directly participate in processing user data or indirectly participate in processing user data, and the reference string includes a reference string for locating the starting position of control flow analysis.

[0051] Specifically, the front-end reference string and the preset boundary binary are obtained.

[0052] According to the preset boundary binary, determine the parameter string corresponding to the inter-process communication write function;

[0053] Determine whether the inter-process communication read function references the parameter string, the inter-process communication read function being a read function corresponding to the inter-process communication write function;

[0054] If yes, the parameter string is the reference string, and the preset boundary binary is the boundary binary.

[0055] For example, according to the file system obtained by the preprocessing module, the boundary binary (the executable binary directly or indirectly participating in processing user data is called boundary binary in the application) for analyzing command injection and buffer overflow is obtained, and the reference string for locating the starting position of control flow analysis is obtained. The specific steps are as follows:

[0056] (3a) Use the SaTC tool in the document "CHEN L, WANG Y, CAI Q, et al. Sharing more and checkingless: Leveraging common input keywords to detect bugs in embedded systems [C] / / 30th USENIX Security Symposium (USENIX Security 21). 2021: 303-319" to obtain the front-end reference string and boundary binary.

[0057] (3b) Obtain the inter-process communication "write" function and the corresponding parameter string from the obtained boundary binary.

[0058] (3c) Find the inter-process communication "read" function corresponding to the inter-process communication "write" function obtained in the previous step from the executable binary of the Linux file system obtained in the preprocessing step. If the parameter string obtained in the previous step is referenced by these "read" functions, add it to the new reference string set, and add these executable binaries to the boundary binary.

[0059] Step 3: Explore the paths in the dynamic link library based on the reference string and the boundary binary to determine the dangerous paths;

[0060] The dangerous path includes a path for calling a dangerous function.

[0061] Specifically, performing path exploration on the boundary binary to determine the path of the hazard function and the path of the external function;

[0062] According to the external function, obtaining a dynamic link library corresponding to the external function, and determining a path for calling the dangerous function in the dynamic link library;

[0063] The path is used as the dangerous path.

[0064] For example, this step uses the boundary binary and reference string obtained in the previous step to generate a path to call the dangerous function through path exploration. The specific steps are as follows:

[0065] (4a) Starting from the code location where the referenced string is called, the boundary binary is explored to find the path of dangerous functions and external functions (in implementation, in order to avoid useless analysis due to too many external functions, the present invention hard-codes a blacklist of external functions, including various common libraries and standard library functions, such as open and close. The functions in these blacklists are not output as external functions in the path generation stage).

[0066] (4b) According to the external function obtained in (4a), find the dynamic link library implemented by the external function, and then enter the function implementation position in the dynamic link library to perform path exploration to find the path of calling the dangerous function.

[0067] That is, 4a finds the path of the dangerous function in the executable binary and the path of the external function, and 4b finds the path of the dangerous path in the corresponding dynamic link library based on the external function obtained in 4a.

[0068] (4c) According to the dangerous path generated in the second step, mark the external function generating the dangerous path as a dangerous alias function, and add the path where the external function exists to the dangerous path generated in the first step as the last dangerous path returned.

[0069] The final unsafe path is shown in Figure 2 It not only includes the path 1→2→5 of the dangerous function in the boundary binary, but also includes the dangerous path 1→3→6 of the dangerous function in the dynamic link library.

[0070] The embodiment of the application obtains a Linux file system; processes the Linux file system to determine a boundary binary for analyzing command injection and buffer overflow and a reference string, the boundary binary includes an executable binary directly participating in processing user data or an executable binary indirectly participating in processing user data, and the reference string includes a reference string for locating a control flow analysis starting point position; explores a path in a dynamic link library according to the reference string and the boundary binary to determine a dangerous path, the dangerous path including a path of calling a dangerous function. Since the application also focuses on the dynamic link library in the Linux-based embedded device, command execution and buffer overflow vulnerabilities in the Linux-based embedded device can be found.

[0071] The embodiment of the application provides an embedded device vulnerability automatic mining method based on a Linux system, which is based on the embodiment shown in Figure 1 The embodiment of the application provides an embedded device vulnerability automatic mining method based on a Linux system, which is based on the embodiment shown in

[0072] After the path in the dynamic link library is explored according to the reference string and the boundary binary to determine the path of calling the dangerous function, the method further includes:

[0073] The boundary binary and the dynamic link library are processed respectively to determine invalid paths in the dangerous path.

[0074] For example, the unsafe path generation stage of the previous step generates a large number of dangerous paths, and invalid paths need to be removed from the dangerous paths. The present application currently mainly supports vulnerability mining of arm architecture and mips architecture. For embedded devices of mips architecture, the present application implements a new static taint analysis engine for filtering invalid paths in dangerous paths. For embedded devices of arm architecture, the modified SaTC taint analysis engine is called.

[0075] The taint analysis objects in the present application include two, namely executable boundary binary and dynamic link library. When the taint analysis object is a dynamic link library, the taint source is defined as the parameter of the entry function, and the sink is the predefined dangerous function. If the taint source can reach the sink without restriction, the entry function is regarded as an "alias function" of the dangerous function. The taint analysis of the boundary binary is based on the taint analysis of the dynamic link library. The taint source is defined as the code position of the call reference string, and the sink is the predefined dangerous function and the "alias function" derived after the taint analysis of the dynamic link library. The taint sink of the boundary binary is as shown in Figure 3

[0076] Optionally, after the Linux file system is acquired, the method further includes:

[0077] According to the Linux file system, a Linux startup script is determined.

[0078] The Linux startup script is regularly interpreted line by line to determine a Shell call tree, and the Shell call tree includes programs, functions, and script names as tree nodes.

[0079] The Shell call tree is traversed to determine a self-starting program list.

[0080] According to the self-starting program list, it is determined that the self-starting program has an exception.

[0081] If yes, the self-starting program is a backdoor program.

[0082] If no, the self-starting program is not a backdoor program.

[0083] For example, backdoor vulnerability discovery includes the following steps:

[0084] (2a) find the Linux startup script from the Linux file system, and use regular line-by-line interpretation of the startup script to call programs or scripts, programs, functions, and script names as tree nodes to construct a Shell call tree. The specific steps are as follows:

[0085] ​(2a1) Find the Shell script automatically run in the process of starting up by inittab file or / etc / init.d / directory, etc.

[0086] (2a2) Translate the Shell script line by line, and add the Shell called command to the child node of the Shell script. Specifically, first split by special symbols such as "&|;" to get each statement executed; then extract the first string as the called command by taking space as the delimiter for each statement.

[0087] (2a3) If the obtained command is a new Shell script or function, find the Shell script, and recursively perform the second step. Until all self-starting scripts are analyzed, the Shell calling tree is obtained.

[0088] (2b) Traverse the Shell calling tree to obtain the self-starting program list, and judge whether the self-starting program is a backdoor. If the program is in the blacklist, or the program is not in the whitelist but has abnormal suspicious behavior (the program calls functions related to network such as listen and functions for executing system commands such as system), the program is regarded as a backdoor.

[0089] The embodiment uses the Linux startup script to construct the Shell calling graph to mine the backdoor vulnerability. The backdoor (such as telnet) not in the startup script will not be regarded as a backdoor, so it has a lower false positive.

[0090] The effect of the present application can be further illustrated by the following simulation experiment.

[0091] 1. Simulation conditions

[0092] The application is on a computer with an Intel(R) Core(TM) i7-10750H central processing unit, a 16 GB memory size, and an Ubuntu 20.04 operating system. The development tools required include IDA Pro version 7.0 and Python version 3.8. In addition, the FirmAE tool in the literature KIM M, KIM D, KIM E, et al. Firmae: Towards large-scale emulation of iot firmware for dynamic analysis [C] / / Annual Computer Security Applications Conference. 2020: 733-745 is used for simulation and emulation during vulnerability verification, and manual analysis of output vulnerability warnings is performed to determine whether the vulnerability is true. The experimental data set includes the firmware data set in SaTC and the self-collected firmware data set, as shown in Tables 1 and 2.

[0093] Table 1 SaTC firmware data set

[0094]

[0095]

[0096] Table 2 Firmware data set collected by the application

[0097] Vendor Device Type Device Serial Number Firmware Number Architecture Tenda Router / Wireless AP AC / G / W 15 arm / mips Blink Router BL 5 mips Trendnet Router / Wireless AP TEW 5 arm / mips Netgear Router R / WNR / MR 3 mips D-Link Router DIR / DAP 5 mips Linksys Router EA / E 3 mips Netcore Router Power 2 arm / mips

[0098] The method compared in the experiment is SaTC, and the reference is CHEN L, WANG Y, CAI Q, et al. Sharing more and checking less: Leveraging common input keywords to detect bugs in embedded systems [C] / / 30th USENIX Security Symposium (USENIX Security 21). 2021: 303-319.

[0099] Simulation content

[0100] According to the specific embodiment of the application, the application is run to mine vulnerabilities in firmware, record the number of mined vulnerabilities, running time, and false positive rate, and compare it with the SaTC method.

[0101] The number of mined vulnerabilities is shown in Tables 3 and 4.

[0102] Table 3 Comparison of the number of vulnerabilities in the SaTC firmware data set

[0103] Vendor Device Type Device Serial Number Firmware Number SaTC Vulnerability Number Invention Vulnerability Number Netgear Router R / XR / WNR 19 5 5 D-Link Router DIR / DSR 5 12 15 Tenda Router AC / W / G 7 10 13 TOTOLink Router A / T 2 2 1 Motorola Router C1 / M2 2 3 2 Axis Camera P / Q 2 0 0

[0104] Table 4 Comparison table of the number of vulnerabilities of the firmware data set collected by the present application

[0105]

[0106]

[0107] Nine firmwares of different manufacturers and different architectures are extracted from the above data set, and the execution time is counted, as shown in Table 4. Figure 4

[0108] Nine firmwares are extracted from the above database, the FirmAE simulation device is used, and the authenticity of the output result is verified by manual verification, and the false positive rate is shown in Table 5.

[0109] Table 5 False positive rate comparison

[0110]

[0111] It can be found that although the false positive rate of the present application is slightly high at present, the present application method can dig out more command execution and buffer overflow vulnerabilities than SaTC, in addition, the execution time of the present application method on the MIPS architecture is obviously reduced compared with SaTC, which verifies the advancement of the present application.

[0112] Figure 5 is a structural schematic diagram of an embodiment of the present application based on a Linux system embedded device vulnerability automatic mining device; as shown in Figure 5 The Linux system embedded device vulnerability automatic mining device provided by the embodiment of the present application comprises: an acquisition module 51, a processing module 52 and a determination module 53, wherein,

[0113] The acquisition module 51 is used to acquire a Linux file system.

[0114] The processing module 52 is used to process the Linux file system, determine boundary binaries and reference strings for analyzing command injection and buffer overflow, the boundary binaries include executable binaries directly participating in processing user data or indirectly participating in processing user data, and the reference strings include reference strings for positioning the starting position of control flow analysis.

[0115] The determination module 53 is used to explore the path in the dynamic link library according to the reference strings and the boundary binaries, and determine a dangerous path, the dangerous path includes a path of calling a dangerous function. ​

[0116] The embodiment of the present application obtains a Linux file system, processes the Linux file system to determine boundary binaries and reference strings for analyzing command injection and buffer overflow, the boundary binaries include executable binaries directly or indirectly participating in processing user data, and the reference strings include reference strings for locating a starting position of a control flow analysis.

[0117] The processing module 52 is specifically configured to obtain a front-end reference string and a preset boundary binary, determine a parameter string corresponding to an inter-process communication write function according to the preset boundary binary, and determine whether an inter-process communication read function references the parameter string, the inter-process communication read function being a read function corresponding to the inter-process communication write function.

[0118] Further, the determining module 53 is specifically configured to perform path exploration on the boundary binary to determine a path of a dangerous function and a path of an external function, obtain a dynamic link library corresponding to the external function according to the external function, and determine a path of calling the dangerous function in the dynamic link library.

[0119] Further, the determining module 53 is further configured to process the boundary binary and the dynamic link library respectively to determine an invalid path in the dangerous path.

[0120] Further, the processing module 52 is further configured to determine a Linux startup script according to the Linux file system, perform regular line-by-line interpretation on the Linux startup script to determine a Shell call tree, the Shell call tree including program, function, and script name as tree nodes, traverse the Shell call tree to determine a self-starting program list, determine whether the self-starting program list is abnormal according to the self-starting program list, and if yes, the self-starting program is a backdoor program, and if no, the self-starting program is not a backdoor program.

[0121] The working principle and technical effects of the embedded device vulnerability automatic mining device based on a Linux system provided by the embodiment of the present application are similar to those of the above method, and will not be repeated here.

Claims

1. A Linux-based embedded device vulnerability automatic mining method, characterized in that: include: Get the Linux file system; Processing the Linux file system to determine a boundary binary and a reference string for analyzing command injection and buffer overflow, wherein the boundary binary includes an executable binary that is directly involved in processing user data or an executable binary that is indirectly involved in processing user data, and the reference string includes a reference string for locating a starting point for control flow analysis; The paths in the dynamic link library are explored based on the reference string and the boundary binary to determine dangerous paths, including paths that call dangerous functions. The processing of the Linux file system to determine boundary binaries and reference strings for analyzing command injection and buffer overflow includes: Get the front-end reference string and the preset boundary binary; Determining a parameter string corresponding to an inter-process communication write function according to the preset boundary binary; determining whether an inter-process communication read function references the parameter string, the inter-process communication read function being a read function corresponding to the inter-process communication write function; If yes, then add the parameter string to the new reference string set and add the preset boundary binary to the boundary binary; The step of exploring paths in a dynamic link library according to the reference string and the boundary binary to determine dangerous paths includes: Starting from the code location where the reference string is called, path exploration is performed on the boundary binary to determine the path of the dangerous function and the path of the external function; According to the external function, a dynamic link library corresponding to the external function is obtained, and a path exploration is performed at the location where the external function is implemented in the dynamic link library to determine a path in which a dangerous function is called in the dynamic link library, and the path is identified as a dangerous path; According to the generated dangerous path, the external function that generates the dangerous path is marked as a dangerous alias function, and the path containing the external function is added to the dangerous path generated in the first step and returned as the final dangerous path.

2. The method for automatically mining vulnerabilities in embedded devices based on the Linux system according to claim 1, characterized in that: After exploring the path in the dynamic link library according to the reference string and the boundary binary to determine the path for calling the dangerous function, the method further includes: The boundary binary and the dynamic link library are processed separately to determine the invalid path in the dangerous path.

3. The method for automatically mining vulnerabilities in embedded devices based on a Linux system according to claim 1, characterized in that: After obtaining the Linux file system, the method further includes: Determine a Linux startup script according to the Linux file system; Perform regular expression interpretation on the Linux startup script line by line to determine a Shell call tree, wherein the Shell call tree includes a program, a function, and a script name as a tree node; Traversing the Shell call tree to determine a list of self-starting programs; Determining, based on the self-starting program list, whether a self-starting program has an abnormality; If so, the self-starting program is a backdoor program; If not, the self-starting program is not a backdoor program.

4. An automatic vulnerability mining device for embedded devices based on Linux system, characterized in that: include: Get module, used to get Linux file system; a processing module, configured to process the Linux file system and determine a boundary binary and a reference string for analyzing command injection and buffer overflow, wherein the boundary binary includes an executable binary that is directly or indirectly involved in processing user data, and the reference string includes a reference string for locating a starting point for control flow analysis; a determination module, configured to explore paths in a dynamic link library according to the reference string and the boundary binary, and determine dangerous paths, wherein the dangerous paths include paths that call dangerous functions; The processing module is specifically configured to obtain a front-end reference string and a preset boundary binary; determine a parameter string corresponding to an inter-process communication write function based on the preset boundary binary; determine whether an inter-process communication read function references the parameter string, and the inter-process communication read function is a read function corresponding to the inter-process communication write function; and if so, add the parameter string to a new reference string set and add the preset boundary binary to the boundary binary; The determination module is specifically used to start from the code position of the call reference string, perform path exploration on the boundary binary, determine the path of the dangerous function and the path of the external function; according to the external function, obtain the dynamic link library corresponding to the external function, and enter the implementation position of the external function in the dynamic link library to perform path exploration, determine the path of calling the dangerous function in the dynamic link library, and use this path as a dangerous path; according to the generated dangerous path, mark the external function that generates the dangerous path as a dangerous alias function, and add the path containing the external function to the dangerous path generated in the first step as the final dangerous path and return it.

5. The automatic vulnerability mining device for embedded devices based on Linux system according to claim 4 is characterized in that: The determination module is further configured to process the boundary binary and the dynamic link library separately to determine the invalid path in the dangerous path.

6. The automatic vulnerability mining device for embedded devices based on Linux system according to claim 4 is characterized in that: The processing module is further configured to determine a Linux startup script based on the Linux file system; perform regular expression interpretation line by line on the Linux startup script to determine a Shell call tree, wherein the Shell call tree includes tree nodes with program, function, and script names as nodes; traverse the Shell call tree to determine a list of self-starting programs; and determine, based on the list of self-starting programs, whether an abnormality exists in the self-starting program; If so, the self-starting program is a backdoor program; if not, the self-starting program is not a backdoor program.

Images