A method, system, medium, and device for detecting fileless Trojans.

Abstract

This invention belongs to the field of information security technology and provides a method, system, medium, and device for detecting fileless Trojans. The method includes: obtaining all loaded classes in the JVM virtual machine; traversing all classes and their parent classes in the JVM virtual machine; determining whether the class files corresponding to each class and its parent class exist on the disk; if not, marking the current class as a high-risk class; if they exist, checking whether the current class contains key classes, methods, or keywords from a preset blacklist; if so, marking it as a risky class; if not, marking it as a non-risky class; extracting the bytecode of the risky class and determining whether it matches the bytecode of the class files on the disk; if they do not match, marking the corresponding risky class as a high-risk class; if they match, it remains a risky class; calculating the score of each high-risk class to determine whether it is a fileless Trojan.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a method, system, medium and device for detecting fileless Trojans. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] Trojans are generally classified into two categories: "file-based Trojans" and "fileless Trojans." "File-based Trojans" are commonly known as "binary Trojans" or "web Trojans"; "fileless Trojans" are a type of fileless attack, with memory Trojans being a common example. Traditional JSP Trojans are highly distinctive and require files to be written to memory, making them easy to detect. Therefore, memory Trojan techniques have emerged. Java "fileless" Trojans, compared to traditional JSP Trojans, are characterized by not having files written to memory; they exist in memory, making them highly stealthy. "Fileless" Trojans work by dynamically adding malicious filter components to a running Tomcat server. This causes malicious code within the filter to be executed when an HTTP request passes through it. Fileless attacks are not new, but they are becoming increasingly prevalent. The Bonnemont Institute found that 35% of all cyberattacks in 2018 were fileless. Trend Micro data shows a significant increase in fileless threat detection tracking from 2018 to the first half of 2019, rising by 396%. According to the latest data from Watchguard Technologies, the detection rate of fileless malware increased by 888% year-on-year in 2020 as attackers became increasingly sophisticated in bypassing traditional security controls. This demonstrates that fileless attacks are being increasingly exploited by attackers for disruptive and destructive activities.

[0004] Currently, the detection of "fileless" Trojans is primarily based on Java Agent technology. This approach cannot cover all types of "fileless" Trojans based on Java containers, and it fails to detect "retransformClasses" type "fileless" Trojans. Furthermore, it may cause application hot updates to fail. The biggest drawback of using Java Agent injection for fileless Trojan detection is that once the Trojan program enters the JVM, it removes the Agent-related APIs, making it impossible for subsequent security software to attach to the target JVM process when using Java Agent technology.

[0005] In summary, the inventors found that existing methods for detecting fileless Trojans have a high false alarm rate, which reduces the accuracy of fileless Trojan identification. Summary of the Invention

[0006] To address the technical problems mentioned above, this invention provides a method, system, medium, and device for detecting fileless Trojans, which can reduce the false alarm rate of fileless Trojan detection methods and improve the accuracy of fileless Trojan identification.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] The first aspect of the present invention provides a method for detecting fileless Trojans.

[0009] In one or more embodiments, a fileless Trojan detection method includes:

[0010] Get all loaded classes in the JVM virtual machine, and iterate through all classes and their parent classes in the JVM virtual machine;

[0011] Determine if the class files for each class and its parent class exist on the disk:

[0012] If it does not exist, then mark the current class as a high-risk class;

[0013] If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class.

[0014] Extract the bytecode of the risk class and determine whether it is consistent with the bytecode of the class file on the disk. If they are inconsistent, mark the corresponding risk class as a high-risk class. If they are consistent, it is still a risk class.

[0015] Based on a preset scoring mechanism and the number of times each high-risk category calls key classes, methods, or keywords on a preset blacklist, the score for each high-risk category is calculated, thereby determining whether it is a fileless Trojan.

[0016] As one implementation method, the process of constructing a preset blacklist is as follows:

[0017] To actually run open-source fileless Trojans in Java containers and application systems;

[0018] Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords.

[0019] Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

[0020] As one implementation method, Serviceability Agent technology is used to extract the bytecode of risk classes.

[0021] The advantages of the above solution are that by using Serviceability Agent technology, it solves the problem that when using Java Agent technology to detect "fileless" Trojans, the `retransformClasses()` method is needed to extract memory bytecode. This method can only obtain the original bytecode of the class, but not the modified bytecode. Furthermore, it can cause the modified class to roll back to its initial state, which may cause normal application hot updates or security hot patches to fail, thereby interfering with the normal operation of business or causing security risks. By using Serviceability Agent technology, it solves the problem that attackers can use techniques to disrupt a certain link in the monitoring process of Java Agent technology and prevent subsequent Agent loading.

[0022] As one implementation method, the process of determining whether it is a fileless Trojan is as follows:

[0023] The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies.

[0024] Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

[0025] A second aspect of the present invention provides a fileless Trojan detection system.

[0026] In one or more embodiments, a fileless Trojan detection system includes:

[0027] The class retrieval and traversal module is used to retrieve all loaded classes in the JVM virtual machine and traverse all classes and their parent classes in the JVM virtual machine.

[0028] The risk level determination module is used for:

[0029] Determine if the class files for each class and its parent class exist on the disk:

[0030] If it does not exist, then mark the current class as a high-risk class;

[0031] If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class.

[0032] Extract the bytecode of the risk class and determine whether it is consistent with the bytecode of the class file on the disk. If they are inconsistent, mark the corresponding risk class as a high-risk class. If they are consistent, it is still a risk class.

[0033] The fileless Trojan detection module is used to calculate the score of each high-risk category based on a preset scoring mechanism and the number of times each high-risk category calls key classes, methods or keywords on a preset blacklist, and then determine whether it is a fileless Trojan.

[0034] As one implementation method, the process of constructing a preset blacklist is as follows:

[0035] To actually run open-source fileless Trojans in Java containers and application systems;

[0036] Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords.

[0037] Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

[0038] As one implementation method, the risk level determination module uses Serviceability Agent technology to extract the bytecode of the risk class.

[0039] As one implementation method, in the fileless Trojan determination module, the process of determining whether it is a fileless Trojan is as follows:

[0040] The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies.

[0041] Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

[0042] A third aspect of the present invention provides a computer-readable storage medium.

[0043] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the fileless Trojan detection method described above.

[0044] A fourth aspect of the present invention provides a computer device.

[0045] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps in the fileless Trojan detection method described above.

[0046] Compared with the prior art, the beneficial effects of the present invention are:

[0047] (1) This invention compares all classes and their parent classes in the JVM virtual machine with class files on the disk, determines the risk category based on whether the current class contains key classes, methods or keywords on the preset blacklist and compares the bytecode of risk classes, and finally calculates the score of each high-risk class based on the preset scoring mechanism and the number of times each high-risk class calls key classes, methods or keywords on the preset blacklist, and determines whether it is a fileless Trojan, thereby reducing the false alarm rate of fileless Trojan methods and improving the accuracy of fileless Trojan identification.

[0048] (2) The adoption of Serviceability Agent technology addresses the issue that when using Java Agent technology to detect "fileless" Trojans, the `retransformClasses()` method is required during memory bytecode extraction. This method only retrieves the original bytecode of the class, not the modified bytecode, and can cause the modified class to revert to its initial state. This could prevent normal application hot updates or security hot patches from functioning, thus interfering with normal business operations or introducing security risks. The adoption of Serviceability Agent technology also solves the problem that attackers can exploit techniques to disrupt a certain stage of the Java Agent monitoring process, preventing subsequent Agent loading.

[0049] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0050] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0051] Figure 1 This is a flowchart of the fileless Trojan detection method according to an embodiment of the present invention;

[0052] Figure 2 This is a schematic diagram illustrating a specific example of fileless Trojan detection in an embodiment of the present invention.

[0053] Figure 3 This is a flowchart illustrating the comparison between class files and blacklists in an embodiment of the present invention.

[0054] Figure 4 This is an architecture diagram of a fileless Trojan detection system according to an embodiment of the present invention. Detailed Implementation

[0055] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0056] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0057] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0058] In existing technologies, interfaces within the Java Agent engine are used to locate the called program and its call stack list from server memory within a web server application. The risk level of the called program is determined based on preset detection rules, call stack logs, and class bytecode information. Based on preset detection strategies and risk levels, class files containing "fileless" Trojans within the called program are identified and removed. However, this technology cannot detect "fileless" Trojans of the retransformClasses type based on JavaAgent technology, allowing hackers to bypass such detection methods. Secondly, attackers can exploit this technology to disrupt a specific step in the Java Agent technology implementation process, preventing subsequent Agent loading.

[0059] In existing technologies, the JVM code segment memory is inspected within the target process. Upon detecting modification of the JVM code segment memory, JIT privileges are acquired. Under JIT privileges, the package names of all classes loaded by the JVM are obtained, and the loaded classes are filtered. The raw data of the filtered classes is obtained through the JIT interface. If modification of the JVM exported function `JVM_EnqueueOperation` is detected, JIT privileges are acquired again. Raw data scanning is then performed using YARA, filtering the loaded classes using whitelists and / or fuzzy blacklists. This technology has two major technical problems: First, while it can detect two main types of "fileless" trojans—those exploiting the Java Servlet specification and those exploiting specific Java frameworks—it cannot detect "fileless" trojans based on Java Agent technology. Second, scanning using YARA rules results in uncontrollable false positive and false negative rates. In practical applications, the quality of the YARA rules directly determines the effectiveness, and online updates of YARA rules are also a significant challenge during engineering implementation.

[0060] In existing technologies, memory trojan intrusion methods can inject malicious code into the JVM through a Java Agent. The detection logic utilizes `attachapi` to inject detection code into the target JVM. `Instrumentation.getAllLoadedClasses()` is used to retrieve all classes. Then, using Java features, reflection is employed to obtain relevant information (such as annotations, methods, and classes) to filter objects that may be hijacked by the trojan. Finally, these initially screened objects are analyzed to check if they actually execute shell commands. This technique has two major problems in practical application: First, when extracting memory bytecode, the `retransformClasses()` method is also needed, which can only obtain the original bytecode of the class, not the modified bytecode. This can also cause modified classes to roll back to their initial state, potentially causing normal application hot updates or security hot patches to fail, thus interfering with normal business operations or introducing security risks. Second, while this technique can detect suspicious components, it cannot confirm that the component is a "fileless" trojan component; further confirmation requires the use of other techniques.

[0061] The inventors discovered that current patents related to detection methods for fileless Trojans are all based on Java Agents, and that Java Agent methods can be countered by attackers, thereby achieving the effect of evading detection.

[0062] To address the aforementioned issues, this invention provides a fileless Trojan detection method, system, medium, and device. It employs Serviceability Agent technology to resolve the problem that attackers can exploit techniques to disrupt a certain stage of the Java Agent monitoring process, preventing subsequent Agent loading.

[0063] The detailed implementation process of the present invention is given below with reference to the accompanying drawings.

[0064] Terminology Explanation:

[0065] Serviceability Agent:

[0066] Serviceability Agent is an advanced debugging tool developed for the Java platform. It can obtain Java objects and internal data structures of the virtual machine within a running Java process or Java Core file. Unlike Java Agent technology, Serviceability Agent runs independently, and its process is isolated from the target JVM process. When using Serviceability Agent technology, it does not modify the data in the target process's memory; it only reads the data in the target process's memory and processes it within its own process.

[0067] Example 1

[0068] like Figure 1 and Figure 2 As shown, this embodiment provides a method for detecting fileless Trojans, which specifically includes the following steps:

[0069] Step 1: Obtain all loaded classes in the JVM virtual machine, and traverse all classes and their parent classes in the JVM virtual machine.

[0070] Step 2: Determine if the class files corresponding to each class and its parent class exist on the disk:

[0071] If it does not exist, then mark the current class as a high-risk class;

[0072] If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class.

[0073] Extract the bytecode of the risk class and determine whether it matches the bytecode of the class file on the disk. If they do not match, mark the corresponding risk class as a high-risk class. If they match, it remains a risk class.

[0074] In practice, the process of constructing the pre-defined blacklist is as follows:

[0075] To actually run open-source fileless Trojans in Java containers and application systems;

[0076] Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords.

[0077] Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

[0078] In this embodiment, the open-source fileless Trojan is a "fileless" Trojan obtained from GitHub, hacker websites, open-source intelligence, etc. These collected "fileless" Trojans are actually run in Java containers and application systems, and JVM memory characteristics and class files in actual operation are extracted through Serviceability Agent technology.

[0079] The following outlines the conditions for successful "fileless" Trojan attacks in three main categories:

[0080] (1) For a "fileless" Trojan exploited by the Java Servlet specification to run successfully, it must comply with the Java specification and API interface requirements, and it needs to be accessed by a hacker via HTTP to trigger function execution and access the "fileless" Trojan. Therefore, it is necessary to capture the relevant class or method requested by the attacker.

[0081] (2) Fileless Trojans based on the Java Servlet specification, such as fileless Trojans under the Java MVC framework, need to be registered as new components to run. Therefore, it is necessary to capture the relevant classes or methods requested by the attacker.

[0082] (3) Fileless Trojans based on Java Agent technology first need to monitor classes in the JVM and replace and modify JVM virtual objects. Therefore, it is necessary to capture the relevant classes or methods requested by the attacker.

[0083] "Fileless" Trojans use a blacklist during operation, which includes class files, class names and methods, class names, and method keywords.

[0084]

[0085]

[0086] Based on keyword features, this invention primarily targets custom classes and methods not covered by blacklists to improve detection accuracy and efficiency. By analyzing commonly used keywords such as memshell, exec, and shell in various popular "fileless" Trojans online, this invention discloses the commonly used keywords for Trojans in the table below. Keyword matching is used to improve detection efficiency and reduce false positive rates.

[0087]

[0088] Among them, Serviceability Agent technology is used to extract JVM virtual machine memory characteristics and class files in actual operation.

[0089] Use Serviceability Agent technology to extract the bytecode of risk classes.

[0090] The advantages of the above solution are that by using Serviceability Agent technology, it solves the problem that when using Java Agent technology to detect "fileless" Trojans, the `retransformClasses()` method is needed to extract memory bytecode. This method can only obtain the original bytecode of the class, but not the modified bytecode. Furthermore, it can cause the modified class to roll back to its initial state, which may cause normal application hot updates or security hot patches to fail, thereby interfering with the normal operation of business or causing security risks. By using Serviceability Agent technology, it solves the problem that attackers can use techniques to disrupt a certain link in the monitoring process of Java Agent technology and prevent subsequent Agent loading.

[0091] like Figure 3 As shown, matching the characteristics of "fileless" Trojans using Serviceability Agent technology requires traversing the classes in the JVM, obtaining the relevant attributes of the target class, checking whether the target class exists on the web server's hard drive, whether the class name and methods are in the blacklist, and whether the executed methods contain keywords from the blacklist such as "memshell, exec, shell, rebeyond, su18". It also involves verifying whether the class file extracted from the JVM virtual machine using Serviceability Agent technology matches the class file on the web server's hard drive. Figure 2 As shown.

[0092] The class files extracted using Serviceability Agent technology can compensate for the shortcomings of Java Agent technology in extracting bytecode files when the CLASS file is corrupted. Using Serviceability Agent technology, class files can still be extracted even when the CLASS file is corrupted. The main steps for extracting class files using Serviceability Agent technology are as follows:

[0093] (1) Execute the jps -v command to obtain the JVM process ID (PID);

[0094] (2) Configure the class names and output directories to be monitored in the Serviceability Agent;

[0095] (3) Use the Serviceability Agent's dump Class class to extract the bytecode of the specified class.

[0096] The core code is as follows:

[0097]

[0098] Step 3: Based on the preset scoring mechanism and the number of times each high-risk category calls key classes, methods, or keywords on the preset blacklist, calculate the score for each high-risk category, and then determine whether it is a fileless Trojan.

[0099] Specifically, the process of determining whether a fileless Trojan is present is as follows:

[0100] The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies.

[0101] Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

[0102] For example, the initial score is set to 0. One point is added for each key class, method, and keyword on the blacklist. For instance, finding calls to the keywords `memshell` and `exec` in a class adds 2 points, and calling `javax.servlet.Filter` adds 1 point. Checking if the bytecode of the extracted risky class matches the bytecode of the class file on the web server's hard drive adds 3 points if they don't match. Once a score of 6 is reached, it can be identified as a "fileless" Trojan.

[0103] The experiment was conducted under Linux, and the main configuration of the experimental environment is shown in the table below.

[0104] System / Software Name / Version operating system CentOS Linux 7.8 Java environment Open JDK 1.8.0 Java containers Apache Tomcat 8.5.6 Java framework Spring MVC 5.2.5

[0105] After testing, the false positive rate of using Serviceability Agent detection technology to detect "fileless" Trojans popular on the Internet was 2.3%, and the accuracy rate reached 95.31% when one hot patch was set.

[0106] Using technology False alarm rate accuracy Monitoring MBeans using Java Visual VM 31.90％ 19.93％ Detection based on Java reflection mechanism 72.21％ 88.53％ Detection based on Java Agent technology 83.33％ 83.62％ Detection based on Serviceability Agent technology 2.3％ 95.31％

[0107] The detection results show that the detection based on Serviceability Agent technology can effectively make up for the shortcomings of existing detection technologies. It can cover all types of "fileless" Trojans based on Java containers, and can even detect "fileless" Trojans that use anti-Trojan technology, thus improving detection efficiency and achieving the expected detection effect.

[0108] This embodiment, based on Serviceability Agent technology, is the first to propose a fileless Trojan detection method. Current patents for fileless Trojan detection methods are all based on Java Agents, which can be countered by attackers, thus achieving evasion detection. Because this invention uses Serviceability Agent technology, there is currently no technology that can evade this countermeasure. Experimental results show that the method in this embodiment has high accuracy and significantly reduces the false positive rate, which is unmatched by other detection technologies.

[0109] This embodiment, based on Serviceability Agent technology, effectively overcomes hackers' "anti-detection countermeasures." Hackers delete the `.java_pid*` socket files, preventing the Java Agent technology from running on the attacked host, thus rendering it unable to detect fileless trojans. Furthermore, using Java Agent technology typically requires shutting down the business system and deploying a new JAR file (this is the Java agent program for detecting fileless trojans). However, the technology of this invention does not require system shutdown and can perform trojan detection in a hot environment. The detection technology based on Serviceability Agent technology uses a more fundamental technological principle than Java Agent technology; that is, the more fundamental the technology, the higher the detection coverage.

[0110] Example 2

[0111] like Figure 4 As shown, this embodiment provides a fileless Trojan detection system, which specifically includes the following modules:

[0112] (1) Class retrieval and traversal module, which is used to retrieve all loaded classes in the JVM virtual machine and traverse all classes and their parent classes in the JVM virtual machine.

[0113] (2) Risk level determination module, which is used for:

[0114] Determine if the class files for each class and its parent class exist on the disk:

[0115] If it does not exist, then mark the current class as a high-risk class;

[0116] If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class.

[0117] Extract the bytecode of the risk class and determine whether it matches the bytecode of the class file on the disk. If they do not match, mark the corresponding risk class as a high-risk class. If they match, it remains a risk class.

[0118] In practice, the process of constructing the pre-defined blacklist is as follows:

[0119] To actually run open-source fileless Trojans in Java containers and application systems;

[0120] Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords.

[0121] Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

[0122] Among them, Serviceability Agent technology is used to extract JVM virtual machine memory characteristics and class files in actual operation.

[0123] Use Serviceability Agent technology to extract the bytecode of risk classes.

[0124] (3) Fileless Trojan Detection Module, which is used to calculate the score of each high-risk class based on the preset scoring mechanism and the number of times each high-risk class calls the key classes, methods or keywords on the preset blacklist, and then determine whether it is a fileless Trojan.

[0125] Specifically, the process of determining whether a fileless Trojan is present is as follows:

[0126] The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies.

[0127] Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

[0128] It should be noted that each module in this embodiment corresponds one-to-one with each step in Embodiment 1, and their specific implementation processes are the same, so they will not be repeated here.

[0129] Example 3

[0130] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the fileless Trojan detection method described above.

[0131] Example 4

[0132] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the fileless Trojan detection method described above.

[0133] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0134] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting fileless Trojans, characterized in that, include: Get all loaded classes in the JVM virtual machine, and iterate through all classes and their parent classes in the JVM virtual machine; Determine if the class files for each class and its parent class exist on the disk: If it does not exist, then mark the current class as a high-risk class; If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class. Extract the bytecode of the risk class and determine whether it is consistent with the bytecode of the class file on the disk. If they are inconsistent, mark the corresponding risk class as a high-risk class. If they are consistent, it is still a risk class. Based on a preset scoring mechanism and the number of times each high-risk category calls key classes, methods, or keywords on a preset blacklist, the score for each high-risk category is calculated to determine whether it is a fileless Trojan. The process of building a default blacklist is as follows: To actually run open-source fileless Trojans in Java containers and application systems; Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords. Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

2. The method for detecting fileless Trojans as described in claim 1, characterized in that, Use Serviceability Agent technology to extract the bytecode of risk classes.

3. The method for detecting fileless Trojans as described in claim 1, characterized in that, The process of determining whether a fileless Trojan is present is as follows: The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies. Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

4. A fileless Trojan detection system, characterized in that, include: The class retrieval and traversal module is used to retrieve all loaded classes in the JVM virtual machine and traverse all classes and their parent classes in the JVM virtual machine. The risk level determination module is used for: Determine if the class files for each class and its parent class exist on the disk: If it does not exist, then mark the current class as a high-risk class; If it exists, check whether the current class contains key classes, methods or keywords from the preset blacklist. If it does, mark it as a risk class; if it does not, mark it as a non-risk class. Extract the bytecode of the risk class and determine whether it is consistent with the bytecode of the class file on the disk. If they are inconsistent, mark the corresponding risk class as a high-risk class. If they are consistent, it is still a risk class. The fileless Trojan detection module is used to calculate the score of each high-risk category based on a preset scoring mechanism and the number of times each high-risk category calls key classes, methods or keywords on a preset blacklist, and then determine whether it is a fileless Trojan. The process of building a default blacklist is as follows: To actually run open-source fileless Trojans in Java containers and application systems; Extract JVM virtual machine memory characteristics and actual running class files to obtain a preliminary blacklist; the JVM virtual machine memory characteristics include key classes, methods, or keywords. Add keywords corresponding to known fileless Trojans to the preliminary blacklist to construct the final blacklist.

5. The fileless Trojan detection system as described in claim 4, characterized in that, In the risk level determination module, Serviceability Agent technology is used to extract the bytecode of the risk class.

6. The fileless Trojan detection system as described in claim 4, characterized in that, In the fileless Trojan detection module, the process of determining whether a program is a fileless Trojan is as follows: The score for each high-risk class is calculated based on the number of times key classes, methods and keywords are called on the preset blacklist, the pre-corresponding score for each call, and the preset score corresponding to bytecode inconsistencies. Based on the comparison between the scores of each high-risk category and the set threshold scores, the high-risk categories that exceed the set threshold scores are determined to be fileless Trojans.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the fileless Trojan detection method as described in any one of claims 1-3.

8. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to perform the steps of the fileless Trojan detection method as described in any one of claims 1-3 above.

Images