WebShell detection method, computer equipment and computer storage medium

Abstract

The embodiment of the present application discloses a WebShell detection method, computer equipment and computer storage medium. The embodiment of the present application includes: determining whether the target code sample is a suspicious WebShell sample based on the idea of virtual execution, and then performing symbolic execution on the tainted path of the suspicious WebShell sample, that is, collecting the path constraints and key variable constraints of the target code sample, and generating a constraint expression based on the path constraints and key variable constraints, judging whether this constraint expression meets the preset results to determine whether the sensitive function in the target code sample can be truly triggered to execute, and finally giving a conclusion on whether the sample is a WebShell. Therefore, compared with the relevant technical solutions, the present application achieves a trade-off between detection accuracy and performance overhead, can identify the filtering operations customized by the code developer in the code, and effectively reduce false positives.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more particularly to a WebShell detection method, a computer device, and a computer storage medium. Background Art

[0002] Program analysis involves analyzing the internal operational processes of programs written in a specific language. This includes data flow analysis and control flow analysis. WebShell detection, as a program analysis method, targets WebShell programs. WebShell is a command execution program that exists as a web page file, also known as a backdoor file. It is a common method used by hackers to invade websites and is typically stored as a web page file such as ASP, PHP, JSP, or CGI.

[0003] Business code often uses filtering functions or validation code to check external input. Existing solutions based on static or dynamic taint analysis have difficulty handling this type of logic. They either ignore validation and mark suspicious parameters with taints, causing false positives; or they default validation to safety and remove taints, causing false negatives. For example, for file upload samples, WebShell detection often does not filter or validate business code parameters. This allows attackers to upload any file, including script files, to further execute malicious code, resulting in false negatives. However, for non-malicious business code, file upload functions typically perform strict validation, such as not being able to upload script files with the suffix .php or .jsp, or only being able to upload files in a limited format (such as image files), resulting in false positives.

[0004] Therefore, there is an urgent need for a solution that can accurately detect WebShell samples in business codes. Summary of the Invention

[0005] The embodiments of the present application provide a WebShell detection method, a computer device, and a computer storage medium for accurately detecting WebShell samples in code samples.

[0006] A first aspect of an embodiment of the present application provides a WebShell detection method, the method comprising:

[0007] Obtaining a target code sample, and determining whether the target code sample includes a sensitive function with controllable parameters;

[0008] If yes, collecting key variable constraints and path constraints of the target code snippet in the target code sample;

[0009] Generate a constraint expression according to the key variable constraint and the path constraint, and solve the constraint expression to obtain a constraint solution result;

[0010] When the constraint solving result meets the preset result, determining that the target code sample is a WebShell sample;

[0011] When the constraint solving result does not meet the preset result, it is determined that the target code sample is not a WebShell sample.

[0012] A second aspect of an embodiment of the present application provides a computer device, the computer device comprising:

[0013] a judging unit, configured to obtain a target code sample and judge whether the target code sample includes a sensitive function with controllable parameters;

[0014] a constraint collection unit, configured to collect key variable constraints and path constraints of a target code segment in the target code sample if the target code sample includes a sensitive function with controllable parameters;

[0015] A generating unit, configured to generate a constraint expression according to the key variable constraint and the path constraint;

[0016] A solving unit, used for solving the constraint expression to obtain a constraint solving result;

[0017] A determination unit, configured to determine that the target code sample is a WebShell sample when the constraint solving result meets a preset result;

[0018] The determining unit is further configured to determine that the target code sample is not a WebShell sample when the constraint solving result does not meet a preset result.

[0019] A third aspect of an embodiment of the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the method of the first aspect when executing the computer program.

[0020] A fourth aspect of an embodiment of the present application provides a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method of the first aspect.

[0021] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0022] In this embodiment, based on the idea of virtual execution, we determine whether the target code sample is a suspicious WebShell sample. Then, we perform symbolic execution on the tainted path of the suspicious WebShell sample. That is, we collect the path constraints and key variable constraints of the target code sample, and generate a constraint expression based on the path constraints and key variable constraints. We then judge whether this constraint expression meets the preset results to determine whether the sensitive functions in the target code sample can actually be triggered and executed, and finally give a conclusion on whether the sample is a WebShell. Therefore, compared with related technical solutions, this application achieves a trade-off between detection accuracy and performance overhead, can identify the filtering operations customized by code developers in the code, and effectively reduce false positives. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A schematic diagram of an application scenario of the WebShell detection method in an embodiment of the present application;

[0024] Figure 2 A flowchart of the WebShell detection method in an embodiment of the present application;

[0025] Figure 3 This is another flowchart of the WebShell detection method in an embodiment of the present application;

[0026] Figure 4 The target code sample and the control flow corresponding to the target code sample in the embodiment of the present application are Figure 1 An exemplary schematic diagram;

[0027] Figure 5 This is a schematic diagram of an example of a command execution type PHP pseudo code in an embodiment of the present application;

[0028] Figure 6 This is a structural diagram of a computer device in an embodiment of the present application;

[0029] Figure 7 This is another structural diagram of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0030] The embodiments of the present application provide a WebShell detection method, a computer device, and a computer storage medium for accurately detecting WebShell samples in code samples.

[0031] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0032] The terms "first," "second," "third," "fourth," and the like in the specification and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] Among related solutions, the more accurate WebShell detection solutions mostly use taint analysis. However, simple static or dynamic analysis makes it difficult to accurately model the harmless treatment (or filtering, verification) of taints, and it is difficult to accurately determine whether filtering is sufficient and eliminate taints when necessary. This is a typical source of false positives in WebShell detection. Static symbolic execution can solve this problem, but WebShells can exploit the complex characteristics of dynamic scripting languages to deform and bypass them. If symbolic execution is used alone, it will be difficult to collect and solve constraints, and the cost is also high.

[0034] To this end, this application proposes a WebShell detection solution that combines virtual execution and symbolic execution. Virtual execution can be performed on both normal samples and WebShells, achieving a very high detection rate and a low false positive rate. Symbolic execution then specifically reduces false positives, for example, addressing situations where non-WebShells are mistakenly identified as WebShells. By combining virtual execution and symbolic execution to detect WebShell samples, a balance is achieved between performance overhead and detection effectiveness.

[0035] For the convenience of description, the professional terms in this application are explained below and will continue to be used in the description of subsequent parts without further elaboration.

[0036] WebShell: A command execution program in the form of a web page file, also known as a script file. It is an important means used by hackers to invade websites. It usually exists in the form of web page files such as asp, php, jsp or cgi.

[0037] Program analysis: Analyzes the internal operation process of a program written in a certain language. This includes data flow analysis and control flow analysis.

[0038] Symbolic execution is a program analysis technique that uses symbolic values instead of concrete values to execute a program, using logical expressions to reflect the program's semantics and explore the relationship between program inputs and execution paths. Symbolic execution is often used in conjunction with SMT solvers to solve constraint expressions and obtain feasible inputs that trigger the paths.

[0039] Taint analysis is a program analysis technique designed to analyze whether data introduced by a taint source (source) within a program can propagate to a taint sink (sink) without being rendered harmless. Taint analysis is often used to characterize data flows within a program and verify whether untrusted external input can reach sensitive locations and threaten the confidentiality and integrity of the system.

[0040] Virtual execution: By modifying the original interpreter of the script language, targeted changes are made to the logic within the interpreter, while maintaining the support of the native functions of the script language and the implementation of the main logic, so that the script can achieve some specific functions during execution.

[0041] A control flow graph (CFG), also known as a control flow graph, is an abstract representation of a process or program. It is an abstract data structure used by compilers and maintained internally. It represents all the paths traversed during program execution. It graphically represents the possible execution flows of all basic blocks within a process and can also reflect the real-time execution of a process.

[0042] Abstract Syntax Tree (AST): An abstract representation of the grammatical structure of source code. It represents the grammatical structure of a programming language in a tree-like form, with each node in the tree representing a structure in the source code.

[0043] An application scenario of the method of the embodiment of the present application is as follows Figure 1 See Figure 1 , an application scenario of the WebShell detection method of the embodiment of the present application includes:

[0044] The service server 100 and the terminal cluster; the terminal cluster may include: terminal device 200a, terminal device 200b, terminal device 200c, ..., terminal device 200n and other terminal devices.

[0045] The business server 100 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud databases, cloud services, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. The terminal devices (including terminal devices 200a, 200b, 200c, ..., 200n) may be smart phones, tablet computers, laptop computers, desktop computers, PDAs, mobile internet devices (MIDs), wearable devices (such as smart watches, smart bracelets, etc.), smart computers, smart cars, and other smart terminals.

[0046] Among them, the business server 100 can establish a communication connection with each terminal device in the terminal cluster, and a communication connection can also be established between each terminal device in the terminal cluster. In other words, the business server 100 can establish a communication connection with each terminal device in the terminal device 200a, terminal device 200b, terminal device 200c, ..., terminal device 200n. For example, a communication connection can be established between the terminal device 200a and the business server 100. A communication connection can be established between the terminal device 200a and the terminal device 200b, and a communication connection can also be established between the terminal device 200a and the terminal device 200c. Among them, the above-mentioned communication connection does not limit the connection method, and can be directly or indirectly connected through a wired communication method, or can be directly or indirectly connected through a wireless communication method, etc. The specific method can be determined according to the actual application scenario, and this application does not impose any restrictions on this.

[0047] It should be understood that Figure 1Each terminal device in the terminal cluster shown can be installed with an application client. When the application client runs in each terminal device, it can interact with the business server 100 respectively, so that the business server 100 can receive business data from each terminal device (such as business management data uploaded by the user through the terminal device). Among them, the application client can be a financial management application, an enterprise affairs management application, a social application, an instant messaging application, a live broadcast application, a game application, a short video application, a video application, a music application, a shopping application, a novel application, a payment application, etc., which has the function of displaying text, images, audio, and video and other data information. The specific application can be determined according to the actual application scenario requirements and is not limited here. Among them, the application client can be an independent client or an embedded sub-client integrated in a client (such as a financial management client, an enterprise affairs management client, etc.). The specific application can be determined according to the actual application scenario and is not limited here.

[0048] The following combination Figure 1 The application scenario shown here describes the WebShell detection method in the embodiment of this application:

[0049] The following describes the WebShell detection method in the embodiment of the present application:

[0050] See also Figure 2 In one embodiment of the present application, a WebShell detection method includes:

[0051] 101. Obtain a target code sample, and determine whether the target code sample includes a sensitive function with controllable parameters;

[0052] The method of this embodiment can be applied to a computer device, which can be a server, terminal, or other computer device capable of performing data processing. For example, in a specific application scenario, the computer device can be Figure 1 The business server 100 or each terminal device in the application scenario shown. When the computer device is a terminal, it can be a personal computer (PC), desktop computer, or other terminal device; when the computer device is a server, it can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud databases, cloud computing, big data, and artificial intelligence platforms.

[0053] The computer device can obtain a target code sample to be detected and determine whether the target code sample can be determined as a suspicious WebShell sample based on the technical idea of virtual execution. The determination method can be: if the target code sample includes a sensitive function with controllable parameters, then the target code sample is identified as a suspicious WebShell sample, and in subsequent steps, it is further verified whether it is actually a WebShell sample; if the target code sample does not contain a sensitive function with controllable parameters, it will be determined as a normal sample, that is, a safe sample that does not endanger the normal operation of the system.

[0054] Controllable parameters refer to the ability of parameters within sensitive functions to be controlled by external computer devices. This means that the execution of the target code sample can be controlled by external computer devices. Clearly, unauthorized individuals can modify the parameters of sensitive functions to control the computer device running the target code sample, allowing them to conduct illegal activities such as stealing confidential information, injecting viruses to attack the operating system, and so on. Therefore, by determining whether the business code includes sensitive functions with controllable parameters, we can initially identify unsafe business code that threatens system operation.

[0055] 102. If yes, collect key variable constraints and path constraints of the target code snippet in the target code sample;

[0056] If the target code sample includes a sensitive function with controllable parameters, the target code sample is determined to be a suspicious WebShell sample. To verify whether this sensitive function with controllable parameters can actually be triggered and executed, the computer device can further verify this using symbolic execution technology. The computer device collects key variable constraints and path constraints of the target code fragment in the target code sample, and generates constraint expressions based on these key variable constraints and path constraints.

[0057] Among them, key variable constraints refer to constraints on the values of key variables, which are variables that can affect the running results of the target code sample; path constraints refer to constraints that can point to different paths of the target code sample.

[0058] 103. Generate a constraint expression according to the key variable constraint and the path constraint, and solve the constraint expression to obtain a constraint solution result;

[0059] After obtaining the key variable constraints and path constraints corresponding to the target code sample, since the key variable constraints and path constraints both serve as constraints on the running process of the target code sample and affect the running results of the target code sample, a constraint expression can be generated based on the key variable constraints and path constraints, and this constraint expression is solved to obtain a constraint solution result, which can characterize the running results of the target code sample.

[0060] 104. When the constraint solving result meets the preset result, determine that the target code sample is a WebShell sample;

[0061] 105. When the constraint solving result does not meet the preset result, determine that the target code sample is not a WebShell sample;

[0062] In this embodiment, when the constraint solving result meets the preset result, the target code sample is determined to be a WebShell sample; when the constraint solving result does not meet the preset result, the target code sample is determined not to be a WebShell sample.

[0063] In this embodiment, based on the idea of virtual execution, we determine whether the target code sample is a suspicious WebShell sample. Then, we perform symbolic execution on the tainted path of the suspicious WebShell sample. That is, we collect the path constraints and key variable constraints of the target code sample, and generate a constraint expression based on the path constraints and key variable constraints. We then judge whether this constraint expression meets the preset results to determine whether the sensitive functions in the target code sample can actually be triggered and executed, and finally give a conclusion on whether the sample is a WebShell. Therefore, compared with related technical solutions, this application achieves a trade-off between detection accuracy and performance overhead, can identify the filtering operations customized by code developers in the code, and effectively reduce false positives.

[0064] The following will be Figure 2 Based on the embodiment shown, the embodiment of the present application is further described in detail. Figure 3 Another embodiment of the WebShell detection method in the embodiment of the present application includes:

[0065] 201. Obtain a target code sample, and determine whether the target code sample includes a sensitive function with controllable parameters;

[0066] In this embodiment, the target code sample may be a code sample of any dynamic scripting language, such as a code sample of a dynamic scripting language such as PHP, JSP, and ASP.

[0067] One way to determine whether a target code sample includes parameter-controllable sensitive parameters may be to use static analysis of virtual execution to establish a control flow graph of the target code sample, and use dynamic analysis of virtual execution to determine a code path of the control flow graph, wherein the code path is associated with at least one basic code block, and the basic code block includes a set of possible values of the variable; determine a first branch among multiple branches of the code path that meets the judgment condition of the basic code block, and determine a second branch among multiple branches of the code path that does not meet the judgment condition of the basic code block, and cut off the second branch; merge the first branch to take the union of possible values of the variables in the basic code block of the first branch, and determine whether the union has a controllable value; if so, determine that the target code sample includes a parameter-controllable sensitive function; if not, determine that the target code sample does not include a parameter-controllable sensitive function.

[0068] For example, Figure 4 As shown, the left side of the arrow is an example of a target code sample, and the right side of the arrow is the control flow graph corresponding to the target code sample. Virtual execution technology includes two parts: static analysis and dynamic analysis. Static analysis is used to solve the problem that dynamic analysis cannot know all possible paths of the code sample, and dynamic analysis is used to solve the problem that static analysis cannot restore some complex semantics. Therefore, when a computer device obtains a target code sample, it can use the static analysis of virtual execution to establish the control flow graph of the target code sample, and use the dynamic analysis of virtual execution to determine the code path of the control flow graph, and obtain the following Figure 4 The control flow graph shown in the figure shows that the "$a = 1" checkbox divides the code into two paths, and each path is associated with at least one basic code block. For example, the code path on the left is associated with the basic code block "$b = $a; print($b);". Furthermore, each basic code block includes a set of possible values for the variable. For example, the basic code block "$b = $a; print($b);" lists the possible values of $b, the basic code block "$a = 1" lists the possible values of $a, and so on.

[0069] Then, a first branch that meets the judgment condition of the basic code block among the multiple branches of the code path is determined, and a second branch that does not meet the judgment condition of the basic code block among the multiple branches of the code path is determined, and the second branch is pruned.

[0070] The first branch can be merged to obtain the union of the possible values of the variables in the basic code block of the first branch, and it is determined whether the union has a controllable value, such as Figure 4As shown, both code paths are branches that satisfy the judgment condition of the basic code block "$a = 1". These two code paths can be merged to obtain the union of possible values of variable $b, and determine whether there is a parameter-controllable value in this union. Obviously, since variable $a can be assigned by the $_GET variable, and the $_GET variable can obtain a value from the outside and assign the obtained value to variable $a, the value of variable $a is controllable. Therefore, when the value of variable $a is assigned to variable $b, it means that the value of variable $b is also controllable, that is, the parameter $b of the sensitive function eval($b) is controllable. It can be determined that the target code sample includes a sensitive function with controllable parameters.

[0071] Among them, the variable $a is the interface for introducing external input, which can be set as a pollution source, and the variable $a can be marked with a pollution mark to indicate that it is a pollution source for introducing external input.

[0072] 202. If yes, collect key variable constraints and path constraints of the target code snippet in the target code sample;

[0073] In this embodiment, key variable constraints and path constraints of the target code fragment in the target code sample are collected. The method can be to determine a preset number of code segments before and after the filter function in the target code sample as the target code fragment, declare the symbolic variable s corresponding to the target variable before the filter function in the target code fragment, and collect key variable constraints and path constraints about the symbolic variable s.

[0074] For example, Figure 5 A command-execution PHP pseudocode is shown, where the variable $input is the source of the taint, introducing external input. Using virtual execution technology, the computer device identifies the pseudocode sample as containing a sensitive function call with controllable parameters, preliminarily identifying the sample as a WebShell. The sensitive function call is the eval() function on line 7 (corresponding to the sink point in the taint analysis). The controllable parameters indicate that the pseudocode sample contains a taint propagation path from the external input (line 2, the source point in the taint analysis) to the sensitive function parameters, namely, $_GET / $_POST → $input → $v → $new.

[0075] For the suspicious path ($_GET / $_POST→$input→$v→$new) identified by the virtual execution analysis, the computer device uses symbolic execution technology to start from the sensitive function call on line 7 and reversely identify the filtering operation on the $new parameter before the call (i.e., the sanitizer() function on line 5). Assuming that sanitizer() is a developer-defined filtering function and the code is known, the symbolic variable sv of $v can be declared before the filtering function operation. Static symbolic execution collects the path constraints and key variable constraints of the filtering process. Then, after the filtering function operation, the key variable constraints of the key variable $new with respect to sv and the path constraints during the filtering process are solved.

[0076] 203. Generate a constraint expression according to the key variable constraint and the path constraint, and solve the constraint expression to obtain a constraint solution result;

[0077] In this embodiment, a constraint expression is generated based on key variable constraints and path constraints. The specific method may be to determine multiple paths pointed to by path constraints in the target code sample and generate a constraint expression for each path under the key variable constraints.

[0078] The specific method for solving the constraint expression may be to input the constraint expression into a solver for solving the constraint expression, and obtain the constraint solution result of the constraint expression output by the solver. For example, the constraint expression may be input into an SMT solver for solving the constraint expression, and obtain the constraint solution result of the SMT solver output.

[0079] 204. When the constraint solving result meets the preset result, determine that the target code sample is a WebShell sample;

[0080] 205. When the constraint solving result does not meet the preset result, determine that the target code sample is not a WebShell sample;

[0081] In this embodiment, when the constraint solving result meets the preset result, the target code sample is determined to be a WebShell sample; when the constraint solving result does not meet the preset result, the target code sample is determined not to be a WebShell sample.

[0082] In this embodiment, a combination of virtual execution and symbolic execution is adopted. Virtual execution is a lighter-weight symbolic execution. It does not accurately represent all variables that depend on external inputs and does not collect path constraints. It performs taint analysis on the variables that depend on external inputs to preliminarily confirm whether the sample has sensitive function calls with controllable parameters. If so, it is determined to be a suspicious WebShell sample. Symbolic execution collects the constraints involved in the filtering / verification process of these suspicious WebShell samples to determine whether the filtering / verification is sufficient. If it is sufficient, the taint is eliminated and the sample is not determined to be a WebShell sample. It can also determine whether the suspicious path analyzed by virtual execution is actually reachable. If it is not reachable, the taint mark of the variable is also eliminated and it is not determined to be a WebShell.

[0083] This solution deploys symbolic execution after virtual execution, reducing its overhead while maintaining detection effectiveness. This significantly enhances its feasibility and specifically addresses the issue of false positives caused by the inability to identify filter functions. This application solution can be widely applied to identifying WebShells, filtering command execution and database operations in code, and has a certain degree of generalization capability, making it suitable for products such as situational awareness and EDR protection terminals.

[0084] The WebShell detection method in the embodiment of the present application is described above. The computer device in the embodiment of the present application is described below. Figure 6 In one embodiment of the present application, a computer device includes:

[0085] A judging unit 501 is configured to obtain a target code sample and judge whether the target code sample includes a sensitive function with controllable parameters;

[0086] A constraint collection unit 502 is configured to collect key variable constraints and path constraints of a target code segment in the target code sample if the target code sample includes a sensitive function with controllable parameters;

[0087] A generating unit 503 is configured to generate a constraint expression according to the key variable constraint and the path constraint;

[0088] A solving unit 504 is used to solve the constraint expression to obtain a constraint solving result;

[0089] A determination unit 505 is configured to determine that the target code sample is a WebShell sample when the constraint solving result meets a preset result;

[0090] The determining unit 505 is further configured to determine that the target code sample is not a WebShell sample when the constraint solving result does not meet a preset result.

[0091] In a preferred implementation of this embodiment, the judgment unit 501 is specifically used to establish a control flow graph of the target code sample using static analysis of virtual execution, and determine a code path of the control flow graph using dynamic analysis of virtual execution, wherein the code path is associated with at least one basic code block, and the basic code block includes a set of possible values of variables; determine a first branch among multiple branches of the code path that meets the judgment condition of the basic code block, and determine a second branch among multiple branches of the code path that does not meet the judgment condition of the basic code block, and prune the second branch; merge the first branches to obtain the union of possible values of the variables in the basic code block of the first branch, and determine whether the union has controllable values; if so, determine that the target code sample includes the parameter-controllable sensitive function; if not, determine that the target code sample does not include the parameter-controllable sensitive function.

[0092] In a preferred implementation of this embodiment, the constraint collection unit 502 is specifically used to determine a preset number of code segments before and after the filter function in the target code sample as the target code fragment; declare the symbolic variable s corresponding to the target variable before the filter function in the target code fragment, and collect key variable constraints and path constraints about the symbolic variable s.

[0093] In a preferred implementation of this embodiment, the generating unit 503 is specifically configured to determine multiple paths pointed to by the path constraints in the target code sample; and generate a constraint expression for each of the paths under the key variable constraints.

[0094] In a preferred implementation of this embodiment, the solving unit 504 is specifically configured to input the constraint expression into a solver for solving, and obtain a constraint solving result of the constraint expression output by the solver.

[0095] In this embodiment, the operations performed by each unit in the computer device are the same as those described above. Figures 2 to 3 The description in the illustrated embodiment is similar and will not be repeated here.

[0096] In this embodiment, based on the idea of virtual execution, we determine whether the target code sample is a suspicious WebShell sample. Then, we perform symbolic execution on the tainted path of the suspicious WebShell sample. That is, we collect the path constraints and key variable constraints of the target code sample, and generate a constraint expression based on the path constraints and key variable constraints. We then judge whether this constraint expression meets the preset results to determine whether the sensitive functions in the target code sample can actually be triggered and executed, and finally give a conclusion on whether the sample is a WebShell. Therefore, compared with related technical solutions, this application achieves a trade-off between detection accuracy and performance overhead, can identify the filtering operations customized by code developers in the code, and effectively reduce false positives.

[0097] The computer device in the embodiment of the present application is described below. Figure 7 In one embodiment of the present application, a computer device includes:

[0098] The computer device 600 may include one or more central processing units (CPUs) 601 and a memory 605 . The memory 605 stores one or more application programs or data.

[0099] Memory 605 may be volatile or persistent storage. The program stored in memory 605 may include one or more modules, each of which may include a series of instruction operations on the computer device. Furthermore, CPU 601 may be configured to communicate with memory 605 and execute the series of instruction operations in memory 605 on computer device 600.

[0100] The computer device 600 may also include one or more power supplies 602, one or more wired or wireless network interfaces 603, one or more input and output interfaces 604, and / or one or more operating systems, such as Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0101] The CPU 601 can execute the aforementioned Figures 2 to 3 The operations performed by the computer device in the illustrated embodiment will not be described in detail here.

[0102] The present application also provides a computer storage medium, wherein one embodiment includes: the computer storage medium stores instructions, and when the instructions are executed on a computer, the computer executes the aforementioned Figures 2 to 3 The operations performed by the computer device in the illustrated embodiment.

[0103] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0105] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0106] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk, and other media that can store program code.

Claims

1. A WebShell detection method, characterized in that: The method comprises: Obtaining a target code sample, and determining whether the target code sample includes a sensitive function with controllable parameters; If yes, collecting key variable constraints and path constraints of the target code snippet in the target code sample; Generate a constraint expression according to the key variable constraint and the path constraint, and solve the constraint expression to obtain a constraint solution result; When the constraint solving result meets the preset result, determining that the target code sample is a WebShell sample; When the constraint solving result does not meet the preset result, determining that the target code sample is not a WebShell sample; The determining whether the target code sample includes a sensitive function with controllable parameters includes: Establishing a control flow graph of the target code sample using static analysis of virtual execution, and determining a code path of the control flow graph using dynamic analysis of virtual execution, wherein the code path is associated with at least one basic code block, the basic code block including a set of possible values of a variable; Merging a first branch of the multiple branches of the code path that meets the judgment condition of the basic code block to obtain a union of possible values of variables in the basic code block of the first branch, and determining whether the union contains a controllable value; If so, determining that the target code sample includes the sensitive function with controllable parameters; If not, it is determined that the target code sample does not include the sensitive function with controllable parameters.

2. The method according to claim 1, characterized in that The collecting of key variable constraints and path constraints of the target code snippets in the target code sample includes: Determining a preset number of code segments before and after the filter function in the target code sample as the target code segments; Declare a symbolic variable s corresponding to the target variable before the filter function in the target code snippet, and collect key variable constraints and path constraints on the symbolic variable s.

3. The method according to claim 1, characterized in that Generating a constraint expression according to the key variable constraint and the path constraint includes: determining a plurality of paths in the target code sample pointed to by the path constraints; A constraint expression for each of the paths under the constraint of the key variables is generated respectively.

4. The method according to claim 1, wherein Solving the constraint expression to obtain a constraint solving result includes: The constraint expression is input into a solver for solving, and a constraint solving result of the constraint expression output by the solver is obtained.

5. A computer device, characterized in that: The computer device comprises: a judging unit, configured to obtain a target code sample and judge whether the target code sample includes a sensitive function with controllable parameters; a constraint collection unit, configured to collect key variable constraints and path constraints of a target code segment in the target code sample if the target code sample includes a sensitive function with controllable parameters; A generating unit, configured to generate a constraint expression according to the key variable constraint and the path constraint; A solving unit, used for solving the constraint expression to obtain a constraint solving result; A determination unit, configured to determine that the target code sample is a WebShell sample when the constraint solving result meets a preset result; The determining unit is further configured to determine that the target code sample is not a WebShell sample when the constraint solving result does not meet a preset result; The judgment unit is specifically used to establish a control flow graph of the target code sample using static analysis of virtual execution, and determine a code path of the control flow graph using dynamic analysis of virtual execution, wherein the code path is associated with at least one basic code block, and the basic code block includes a set of possible values of variables; merge the first branch of multiple branches of the code path that meets the judgment condition of the basic code block to take the union of possible values of the variables in the basic code block of the first branch, and judge whether the union has controllable values; if so, determine that the target code sample includes the parameter-controllable sensitive function; if not, determine that the target code sample does not include the parameter-controllable sensitive function.

6. The computer device according to claim 5, wherein: The constraint collection unit is specifically used to determine a preset number of code segments before and after the filter function in the target code sample as the target code fragment; declare the symbolic variable s corresponding to the target variable before the filter function in the target code fragment, and collect key variable constraints and path constraints about the symbolic variable s.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

8. A computer storage medium, characterized in that The computer storage medium stores instructions, which, when executed on a computer, enable the computer to perform the method according to any one of claims 1 to 4.

Images