Rebound shell behavior detection method, system, storage medium and terminal

Abstract

The present application provides a method for detecting rebound shell behavior, including: obtaining a data packet in the reverse transport layer of a secure shell protocol SSH connection; determining the data packet type contained in the data packet; if the data size of each of the data packets satisfies the threshold interval corresponding to the data packet type to which it belongs, determining that a rebound shell behavior exists. The present application does not need to rely on terminal process information, does not need to detect the SSH rebound shell command in the terminal command line, and detects the SSH rebound shell behavior completely through the traffic side. Secondly, the present application does not rely on specific fields of the SSH protocol, does not need to decrypt the SSH encrypted traffic, and can detect the SSH rebound shell behavior only based on the data packet characteristics passing through the reverse transport layer of the SSH session. The present application also provides a rebound shell behavior detection system, storage medium and terminal, which have the above-mentioned beneficial effects.

Description

Technical Field

[0001] The present application relates to the field of data storage, and in particular to a method, system, storage medium, and terminal for detecting rebound shell behavior. Background Art

[0002] During intranet penetration, hackers often use rebound shells to bypass firewall port policies and gain control of intranet hosts. A rebound shell occurs when a control terminal listens on a TCP / UDP port, the controlled terminal initiates requests to that port, and then forwards its command line input and output to the control terminal. A rebound shell corresponds to standard shells like telnet and SSH, essentially reversing the roles of client and server in network terms. It is typically used when the controlled terminal is restricted by a firewall, has insufficient permissions, or has a blocked port. An SSH (Secure Shell) rebound shell is a rebound shell method based on the SSH protocol. Compared to rebound shells based on other protocols, SSH automatically encrypts and decrypts all traffic between the SSH client and server, effectively avoiding firewall detection. Virtually all Linux servers ship with the SSH protocol, paving the way for widespread use of SSH rebound shells.

[0003] Currently, detection is mainly based on terminal process information. It is necessary to monitor the host or server equipped with the SSH protocol. When it generates a command line to build an SSH rebound shell, it is determined that this host has SSH rebound shell behavior. However, this method can only detect hosts with Linux systems. For customized SSH software on the Windows side, the commands executed in it cannot be captured, and it is easy for the execution of SSH rebound shell by the intranet Windows host to be missed.

[0004] Therefore, how to improve the detection efficiency of SSH rebound shell is a technical problem that those skilled in the art urgently need to solve. Summary of the Invention

[0005] The purpose of this application is to provide a method, system, storage medium, and terminal for detecting rebound shell behavior, which can improve the efficiency of detecting SSH rebound shells.

[0006] To solve the above technical problems, this application provides a method for detecting rebound shell behavior. The specific technical solution is as follows:

[0007] Capture data packets in the reverse transport layer of the Secure Shell Protocol (SSH) connection;

[0008] Determining the data packet type contained in the data packet;

[0009] If the data size of each of the data packets meets the threshold range corresponding to the data packet type to which it belongs, it is determined that a rebound shell behavior exists.

[0010] Optionally, before obtaining the data packet in the reverse transport layer of the Secure Shell Protocol (SSH) connection, the following is also included:

[0011] Confirm that the Secure Shell Protocol (SSH) connection has been successfully established;

[0012] A reverse secure shell protocol SSH connection included in the secure shell protocol SSH connection is detected, and the reverse secure shell protocol SSH connection is used as the reverse transport layer.

[0013] Optionally, obtaining data packets in the reverse transport layer of a Secure Shell (SSH) connection includes:

[0014] Obtain any one or a combination of identification substrings, algorithm negotiation packets, key exchange packets, and key confirmation packets in the reverse transport layer of a Secure Shell (SSH) protocol connection.

[0015] Optionally, if the data size of each data packet satisfies a threshold value corresponding to the data packet type, before determining that a rebound shell behavior exists, the method further includes:

[0016] Determine threshold intervals corresponding to the identification substring, the algorithm negotiation data packet, the key exchange data packet, and the key confirmation data packet.

[0017] Optionally, obtaining data packets in the reverse transport layer of a Secure Shell (SSH) connection includes:

[0018] During a secure shell protocol (SSH) connection, the two parties execute a protocol version exchange, obtaining the identification substring in the reverse transport layer;

[0019] During the algorithm negotiation phase between two parties of a secure shell protocol (SSH) connection, obtaining the algorithm negotiation data packet in the reverse transport layer;

[0020] During the key exchange phase between two parties of a secure shell protocol (SSH) connection, the key exchange data packet and the key confirmation data packet in the reverse transport layer are obtained.

[0021] Optionally, if the data size of each data packet satisfies a threshold range corresponding to the data packet type, determining that a rebound shell behavior exists includes:

[0022] If the data packet size of the identification substring meets the first threshold interval, performing data packet size detection on the algorithm negotiation data packet;

[0023] If the data packet size of the algorithm negotiation data packet meets the second threshold interval, performing data packet size detection on the key exchange data packet;

[0024] If the data packet size of the key exchange data packet meets a third threshold interval, performing a data packet size detection on the key confirmation data packet;

[0025] If the data packet size of the key exchange data packet meets the fourth threshold range, it is confirmed that the rebound shell behavior exists.

[0026] Optionally, obtaining data packets in the reverse transport layer of a Secure Shell (SSH) connection includes:

[0027] Get all packets in the Secure Shell Protocol (SSH) connection;

[0028] detecting a data packet transmission direction of each of the data packets;

[0029] The data packet in the reverse transmission layer is determined according to the data packet transmission direction.

[0030] This application also provides a rebound shell behavior detection system, including:

[0031] A data packet acquisition module is used to acquire data packets in a reverse transport layer of a secure shell protocol SSH connection;

[0032] A data packet type detection module, configured to determine the data packet type contained in the data packet;

[0033] The data packet size detection module is used to determine whether a rebound shell behavior exists if the data size of each data packet meets the threshold range corresponding to the data packet type to which it belongs.

[0034] Optionally, also include:

[0035] The reverse transport layer determination module is used to confirm the successful establishment of the secure shell protocol SSH connection; detect the reverse secure shell protocol SSH connection included in the secure shell protocol SSH connection, and use the reverse secure shell protocol SSH connection as the reverse transport layer.

[0036] The present application also provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the above-described method when executed by a processor.

[0037] The present application also provides a terminal, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of the above-mentioned method when calling the computer program in the memory.

[0038] The present application provides a method for detecting rebound shell behavior, comprising: obtaining data packets in a reverse transport layer of a secure shell protocol (SSH) connection; determining the data packet type contained in the data packet; and determining the presence of rebound shell behavior if the data size of each data packet meets a threshold range corresponding to the data packet type to which it belongs.

[0039] This application achieves the purpose of detecting rebound shells in encrypted SSH traffic by capturing a series of SSH data packet features and matching specific behaviors in the SSH rebound shell construction process. There is no need to rely on terminal process information, and there is no need to detect SSH rebound shell commands in the terminal command line. The SSH rebound shell behavior is detected entirely through the traffic side. Secondly, this application does not rely on specific fields of the SSH protocol, and there is no need to decrypt SSH encrypted traffic. The SSH rebound shell behavior can be detected only based on the data packet features of the reverse transport layer of the SSH session. It can be seen that this application provides a new method for detecting SSH rebound shell behavior, which has strong universality and is easy to be widely used in various types of equipment.

[0040] The present application also provides a rebound shell behavior detection system, storage medium and terminal, which have the above-mentioned beneficial effects and are not described in detail here. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0042] Figure 1 A flowchart of a method for detecting rebound shell behavior provided in an embodiment of the present application;

[0043] Figure 2 A diagram showing the operating principle of the SSH rebound shell provided for this application;

[0044] Figure 3 A diagram showing the sequence of data packet interactions during a secure shell protocol (SSH) connection provided for this application.

[0045] Figure 4 A schematic diagram of the reverse data packet transmission process provided in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of the structure of a rebound shell behavior detection system provided in an embodiment of the present application;

[0047] Figure 6 A schematic diagram of the structure of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0049] See also Figure 1 , Figure 1 This is a flowchart of a method for detecting rebound shell behavior provided by an embodiment of the present application, the method comprising:

[0050] S101: obtaining data packets in a reverse transport layer of a secure shell protocol (SSH) connection;

[0051] S102: Determine the data packet type included in the data packet;

[0052] S103: If the data size of each data packet satisfies the threshold range corresponding to the data packet type, it is determined that a rebound shell behavior exists.

[0053] In order to better describe the detection method of rebound shell behavior provided by the present application, the following describes the rebound shell of the secure shell protocol SSH connection.

[0054] See also Figure 2 , Figure 2 The operating principle diagram of SSH rebound shell provided for this application, Figure 1 In the example, Secure Shell Protocol (SSH) connection A is an SSH encrypted connection established by the attacker's script on the compromised host side, and Secure Shell Protocol (SSH) connection B is an SSH connection established by the attacker's machine in reverse under Secure Shell Protocol (SSH) connection A. Its ultimate goal is to use the external network control host as the client shell to control the compromised internal network host as the server shell.

[0055] See also Figure 3 , Figure 3 The diagram of the packet interaction sequence during the Secure Shell Protocol (SSH) connection process provided for this application mainly includes the following three processes:

[0056] 1) Protocol Version Exchange: When a Secure Shell (SSH) connection is established, both parties must send an identification substring. The specific process is that the client first sends an SSH PROTOCOL packet to the server, and the server then returns an SSH PROTOCOL packet to the client.

[0057] The specific format of the identification substring is not limited here. A feasible format may be as follows: SSH-protoversion-softwareversion SP comments CR LF, which may consist of the SSH version number, custom information, spaces, comments, etc.

[0058] 2) Algorithm Negotiation: The key negotiation process begins with the client and server exchanging Key Exchange Init requests, primarily to inform each other of their supported encryption algorithms and MAC algorithms. Specifically, the client sends a KEX INIT packet to the server, which then returns a KEX INIT packet to the client. The KEX INIT packet represents the algorithm negotiation packet.

[0059] 3) Diffie-Hellman Key Exchange: This phase begins when the client sends DH_GEX_INIT and ends when either party sends a NEW_KEYS message. For example, the client might first send a DH_GEX_INIT packet to the server, which then returns a DH_GEX_REPLY packet to the client. Finally, the client sends NEW_KEYS to the server. The DH_GEX_INIT packet is the key exchange packet, while NEW_KEYS is the key confirmation packet.

[0060] In step S101, it is necessary to obtain the data packet in the reverse transport layer of the secure shell protocol SSH connection. This process defaults to confirming the reverse transport layer in the secure shell protocol SSH connection in advance or during execution. The so-called reverse transport layer can first confirm the successful establishment of the secure shell protocol SSH connection, and then detect the reverse secure shell protocol SSH connection contained in the traffic of the secure shell protocol SSH connection, and then use the reverse secure shell protocol SSH connection as the reverse transport layer. The reverse transport layer is as follows: Figure 2 The Secure Shell Protocol (SSH) connection B in the example is still on the traffic side of the Secure Shell Protocol (SSH) connection A. However, the SSH connection is actually established by the external control host through a vulnerability exploitation script to enable the compromised internal host to establish the Secure Shell Protocol (SSH) connection with the external control host. Therefore, its traffic transmission path can be regarded as the reverse transport layer.

[0061] Secondly, this embodiment does not limit the method for acquiring data packets. When acquiring data packets in the reverse transport layer, the acquisition can be done all at once, or multiple times during different transmission processes. As mentioned above, a Secure Shell (SSH) connection consists of several phases, each of which involves data exchange between the two parties and corresponding data packet exchanges. However, this step focuses only on data packets in the reverse transport layer and does not acquire data packets within the Secure Shell (SSH) connection.

[0062] In addition, this step does not limit the type of data packet to be obtained. Any one or any combination of the following can be obtained: an identification substring in the reverse transport layer of a secure shell protocol (SSH) connection, an algorithm negotiation data packet, a key exchange data packet, and a key confirmation data packet. The specific process can be as follows:

[0063] S101A: During a phase of performing a protocol version exchange between two parties of a Secure Shell (SSH) connection, obtaining the identification substring in the reverse transport layer;

[0064] S101B: During the algorithm negotiation phase between two parties of the Secure Shell Protocol (SSH) connection, the algorithm negotiation data packet in the reverse transport layer is obtained;

[0065] S101C: During the key exchange phase between two parties of the Secure Shell Protocol (SSH) connection, the key exchange data packet and the key confirmation data packet in the reverse transport layer are obtained.

[0066] In another embodiment of the present application, when executing this step, all data packets in the secure shell protocol SSH connection process can be obtained, for example, Figure 2 The method further comprises the following steps: receiving all data packets of the Secure Shell Protocol SSH connection A and the Secure Shell Protocol SSH connection B, performing direction detection on the data packets, and determining the data packets belonging to the reverse transport layer from all the data packets according to the detected data packet transmission direction.

[0067] In step S102, the packet type of the acquired data packet must be determined. This confirmation is required for each data packet acquired in step S101. If step S101 is performed multiple times, i.e., multiple reverse transport layer data packets are acquired, this step can also be performed multiple times to determine the packet type. The packet type refers to the stage of the Secure Shell (SSH) connection in which the packet is located. Data packets in different stages of the SSH connection have distinct characteristics.

[0068] In step S103, the packet size and the corresponding threshold range for the packet type are determined. If the packet size meets the corresponding threshold range for the packet type, a rebound shell is confirmed. In this step, each packet type is compared with the corresponding threshold range, and the threshold ranges for different packet types may vary.

[0069] It is easy to understand that this embodiment defaults to confirming or obtaining the threshold intervals corresponding to each data packet type before performing this step. For example, if the data packet includes an identification substring, an algorithm negotiation data packet, a key exchange data packet, and a key confirmation data packet, then the threshold intervals corresponding to the identification substring, algorithm negotiation data packet, key exchange data packet, and key confirmation data packet can be determined before performing this step. Taking the example of the identification substring, algorithm negotiation data packet, key exchange data packet, and key confirmation data packet corresponding to the first threshold interval, the second threshold interval, the third threshold interval, and the fourth threshold interval, respectively, the execution process of this step can be specifically as follows:

[0070] If the data packet size of the identification substring meets the first threshold interval, performing data packet size detection on the algorithm negotiation data packet;

[0071] If the data packet size of the algorithm negotiation data packet meets the second threshold interval, performing data packet size detection on the key exchange data packet;

[0072] If the data packet size of the key exchange data packet meets a third threshold interval, performing a data packet size detection on the key confirmation data packet;

[0073] If the data packet size of the key exchange data packet meets the fourth threshold range, it is confirmed that the rebound shell behavior exists.

[0074] The first threshold interval, the second threshold interval, the third threshold interval, and the fourth threshold interval are not limited herein, and there is no relationship between the threshold intervals. In a feasible implementation, the first threshold interval T1, the second threshold interval T2, the third threshold interval T3, and the fourth threshold interval T4 can be T1∈[50,150], T2∈[500,5000], T3∈[50,200], and T4∈[50,150], respectively, in bytes. Those skilled in the art can customize and adjust the first threshold interval, the second threshold interval, the third threshold interval, and the fourth threshold interval according to the circumstances.

[0075] In the above process, packet size detection is performed on the next packet only after successful detection of the previous packet type. This is because each of these packets is generated sequentially during the Secure Shell (SSH) connection process, enabling real-time detection during the SSH connection, improving detection efficiency. If the device has sufficient computing resources, it is also possible to obtain all of the above packet types at once and perform parallel detection of packets corresponding to different packet types.

[0076] The embodiment of the present application achieves the purpose of detecting rebound shells in encrypted SSH traffic by capturing a series of SSH data packet features and matching specific behaviors in the process of setting up SSH rebound shells. There is no need to rely on terminal process information, and there is no need to detect SSH rebound shell commands in the terminal command line. The SSH rebound shell behavior is detected entirely through the traffic side. Secondly, the present application does not rely on specific fields of the SSH protocol, and there is no need to decrypt the SSH encrypted traffic. The SSH rebound shell behavior can be detected only based on the data packet features of the reverse transport layer of the SSH session. It can be seen that the present application provides a new method for detecting SSH rebound shell behavior, which has strong universality and is easy to be widely used in various types of equipment.

[0077] See also Figure 4 , Figure 4 The reverse data packet sending process diagram provided in the embodiment of the present application is that the SSH rebound shell is a secure shell protocol SSH connection A that has been successfully established, in which the external network control host as the server initiates a secure shell protocol SSH connection B to the internal network compromised host as the client. And this secure shell protocol SSH connection B is also displayed in the secure shell protocol SSH connection A on the traffic side. In the secure shell protocol SSH connection A, the external network control host acts as the server, and the internal network compromised host acts as the client. In order to build the secure shell protocol SSH connection B, they will reverse the connection order to build the SSH transmission. To this end, the present application detects a series of transport layer construction data packets sent by the external network control host to the internal network compromised host in the secure shell protocol SSH connection A to achieve the detection of rebound shell behavior.

[0078] Figure 4 In the example, the server in the secure shell protocol SSH connection A sends an SSH PROTOCOL data packet to the client in the secure shell protocol SSH connection A. After receiving the SSH PROTOCOL data packet, the client in the secure shell protocol SSH connection A returns its own SSH PROTOCOL data packet to the server in the secure shell protocol SSH connection A.

[0079] Afterwards, the server in the secure shell protocol SSH connection A sends a KEX INIT packet to the client in the secure shell protocol SSH connection A. After receiving the KEX INIT packet, the client in the secure shell protocol SSH connection A returns a KEX INIT packet containing a list of related encryption algorithms supported by itself and a list of algorithms of the server in the secure shell protocol SSH connection A.

[0080] The server in SSH connection A then sends a DH_GEX_INIT packet to the client in SSH connection A to implement key exchange. The client in SSH connection A then sends a DH_GEX_REPLY packet to the server in SSH connection A. Finally, the server in SSH connection A returns NEW_KEYS, and the SSH connection process ends.

[0081] This application only needs to detect the data packets involved in the above process to detect rebound shell behavior.

[0082] See also Figure 5 , Figure 5 This is a structural diagram of a rebound shell behavior detection system provided in an embodiment of the present application. The rebound shell behavior detection system described below can be referenced and compared with the rebound shell behavior detection method described above. The system specifically includes

[0083] A data packet acquisition module is used to acquire data packets in a reverse transport layer of a secure shell protocol SSH connection;

[0084] A data packet type detection module, configured to determine the data packet type contained in the data packet;

[0085] The data packet size detection module is used to determine whether a rebound shell behavior exists if the data size of each data packet meets the threshold range corresponding to the data packet type to which it belongs.

[0086] Based on the above embodiment, as a preferred embodiment, it also includes:

[0087] The reverse transport layer determination module is used to confirm the successful establishment of the secure shell protocol SSH connection; detect the reverse secure shell protocol SSH connection included in the secure shell protocol SSH connection, and use the reverse secure shell protocol SSH connection as the reverse transport layer.

[0088] Based on the above embodiment, as a preferred embodiment, obtaining a data packet in the reverse transport layer of a secure shell protocol SSH connection includes:

[0089] Obtain any one or a combination of identification substrings, algorithm negotiation packets, key exchange packets, and key confirmation packets in the reverse transport layer of a Secure Shell (SSH) protocol connection.

[0090] Based on the above embodiment, as a preferred embodiment, if the data size of each data packet meets the threshold range corresponding to the data packet type to which it belongs, before determining that a rebound shell behavior exists, the following is further included:

[0091] Determine threshold intervals corresponding to the identification substring, the algorithm negotiation data packet, the key exchange data packet, and the key confirmation data packet.

[0092] Based on the above embodiment, as a preferred embodiment, obtaining a data packet in the reverse transport layer of a secure shell protocol SSH connection includes:

[0093] During a secure shell protocol (SSH) connection, the two parties execute a protocol version exchange, obtaining the identification substring in the reverse transport layer;

[0094] During the algorithm negotiation phase between two parties of a secure shell protocol (SSH) connection, obtaining the algorithm negotiation data packet in the reverse transport layer;

[0095] During the key exchange phase between two parties of a secure shell protocol (SSH) connection, the key exchange data packet and the key confirmation data packet in the reverse transport layer are obtained.

[0096] Based on the above embodiment, as a preferred embodiment, the data packet size detection module includes:

[0097] A first detection module is configured to perform a data packet size detection on the algorithm negotiation data packet if the data packet size of the identification substring meets a first threshold interval;

[0098] A second detection module is configured to perform a data packet size detection on the key exchange data packet if the data packet size of the algorithm negotiation data packet meets a second threshold interval;

[0099] a third detection module, configured to perform a data packet size detection on the key confirmation data packet if the data packet size of the key exchange data packet meets a third threshold interval;

[0100] The behavior confirmation module is configured to confirm the presence of a rebound shell behavior if the data packet size of the key exchange data packet meets a fourth threshold range.

[0101] The present application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, can implement the steps of the method provided in the above embodiment. The storage medium may include: a USB flash drive, a mobile hard drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc., which can store program code.

[0102] The present application also provides a terminal, which may include a memory and a processor. The memory stores a computer program, and when the processor calls the computer program in the memory, the steps of the method provided in the above embodiment can be implemented. Of course, the terminal may also include various network interfaces, power supplies and other components. Figure 6 , Figure 6 This is a structural diagram of a terminal provided in an embodiment of the present application. The terminal in this embodiment may include: a processor 2101 and a memory 2102.

[0103] Optionally, the terminal may further include a communication interface 2103 , an input unit 2104 , a display 2105 , and a communication bus 2106 .

[0104] The processor 2101 , the memory 2102 , the communication interface 2103 , the input unit 2104 , and the display 2105 all communicate with each other via the communication bus 2106 .

[0105] In the embodiment of the present application, the processor 2101 may be a central processing unit (CPU), an application specific integrated circuit, a digital signal processor, a readily available programmable gate array, or other programmable logic devices.

[0106] The processor may call a program stored in the memory 2102. Specifically, the processor may execute the operations executed by the terminal in the above embodiment.

[0107] The memory 2102 is used to store one or more programs. The programs may include program codes, and the program codes include computer operating instructions. In the embodiment of the present application, the memory stores at least a program for implementing the following functions:

[0108] In one possible implementation, the memory 2102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and applications required for at least one function, etc.; the data storage area may store data created during the use of the computer.

[0109] In addition, the memory 2102 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device or other volatile solid-state storage device.

[0110] The communication interface 2103 may be an interface of a communication module, such as an interface of a GSM module.

[0111] The present application may further include a display 2105 and an input unit 2104 and the like.

[0112] Figure 6 The structure of the terminal shown does not constitute a limitation on the terminal in the embodiment of the present application. In actual applications, the terminal may include Figure 6 More or fewer components than shown, or combinations of certain components.

[0113] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems provided in the embodiments, since they correspond to the methods provided in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0114] This document uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only intended to help understand the method and core ideas of this application. It should be noted that for those skilled in the art, without departing from the principles of this application, various improvements and modifications can be made to this application, and such improvements and modifications also fall within the scope of protection of the claims of this application.

[0115] It should also be noted that, in this specification, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.

Claims

1. A method for detecting rebound shell behavior, characterized in that: include: Capture data packets in the reverse transport layer of the Secure Shell Protocol (SSH) connection; Determining the data packet type contained in the data packet; If the data size of each of the data packets meets the threshold range corresponding to the data packet type, it is determined that a rebound shell behavior exists; Before obtaining the data packet in the reverse transport layer of the Secure Shell Protocol (SSH) connection, the following steps are also included: Confirm that the Secure Shell Protocol (SSH) connection has been successfully established; The step of obtaining a data packet in a reverse transport layer of a secure shell protocol (SSH) connection includes: A reverse secure shell protocol SSH connection included in the secure shell protocol SSH connection is detected, where the reverse secure shell protocol SSH connection is the reverse transport layer.

2. The method for detecting rebound shell behavior according to claim 1, characterized in that: Capturing the reverse transport layer data packets in a Secure Shell (SSH) connection includes: Obtain any one or a combination of identification substrings, algorithm negotiation packets, key exchange packets, and key confirmation packets in the reverse transport layer of a Secure Shell (SSH) protocol connection.

3. The method for detecting rebound shell behavior according to claim 2, characterized in that: If the data size of each data packet meets the threshold range corresponding to the data packet type, before determining that a rebound shell behavior exists, the following steps are also performed: Determine threshold intervals corresponding to the identification substring, the algorithm negotiation data packet, the key exchange data packet, and the key confirmation data packet.

4. The method for detecting rebound shell behavior according to claim 2 or 3, characterized in that: Capturing the reverse transport layer data packets in a Secure Shell (SSH) connection includes: During a secure shell protocol (SSH) connection, the two parties execute a protocol version exchange, obtaining the identification substring in the reverse transport layer; During the algorithm negotiation phase between two parties of a secure shell protocol (SSH) connection, obtaining the algorithm negotiation data packet in the reverse transport layer; During the key exchange phase between two parties of a secure shell protocol (SSH) connection, the key exchange data packet and the key confirmation data packet in the reverse transport layer are obtained.

5. The method for detecting rebound shell behavior according to claim 4, characterized in that: If the data size of each data packet meets the threshold range corresponding to the data packet type, it is determined that a rebound shell behavior exists, including: If the data packet size of the identification substring meets the first threshold interval, performing data packet size detection on the algorithm negotiation data packet; If the data packet size of the algorithm negotiation data packet meets the second threshold interval, performing data packet size detection on the key exchange data packet; If the data packet size of the key exchange data packet meets a third threshold interval, performing a data packet size detection on the key confirmation data packet; If the data packet size of the key exchange data packet meets the fourth threshold range, it is confirmed that the rebound shell behavior exists.

6. The method for detecting rebound shell behavior according to claim 1, characterized in that: Capturing the reverse transport layer data packets in a Secure Shell (SSH) connection includes: Get all packets in the Secure Shell Protocol (SSH) connection; detecting a data packet transmission direction of each of the data packets; The data packet in the reverse transmission layer is determined according to the data packet transmission direction.

7. A detection system for rebound shell behavior, characterized in that: include: Reverse transport layer confirmation module, used to confirm the successful establishment of the Secure Shell Protocol SSH connection; detecting a reverse secure shell protocol (SSH) connection included in the secure shell protocol (SSH) connection, and using the reverse secure shell protocol (SSH) connection as the reverse transport layer; A data packet acquisition module is used to acquire data packets in a reverse transport layer of a secure shell protocol SSH connection; A data packet type detection module, configured to determine the data packet type contained in the data packet; The data packet size detection module is used to determine whether a rebound shell behavior exists if the data size of each data packet meets the threshold range corresponding to the data packet type to which it belongs.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for detecting rebound shell behavior according to any one of claims 1 to 6 are implemented.

9. A terminal, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the processor calls the computer program in the memory, the steps of the method for detecting rebound shell behavior according to any one of claims 1 to 6 are implemented.

Images