A Webshell file detection method, device, equipment and storage medium

Abstract

The application provides a Webshell file detection method and device, equipment and a storage medium, wherein the method comprises: obtaining an operation mode of a current operation on a server and a source file to which an operation request corresponding to the operation mode belongs; updating the value of a judgment parameter N according to the operation mode and a preset parameter update condition; wherein N is a constant greater than 0; in the case that N is greater than a preset value, the source file is determined to be a Webshell file. The above scheme can determine that the source file is a Webshell file without detecting the specific content of the file, which not only avoids the possibility that an attacker may bypass the detection of the protection system through rules, but also still has accurate and comprehensive detection capability for variant or updated Webshell files.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a Webshell file detection method and device, equipment and a storage medium. BACKGROUND

[0002] With the development of Internet technology, the number of applications on the Internet is increasing, and network security incidents have also emerged. Attackers can attack websites through various vulnerabilities, ultimately upload Webshell (commonly known as backdoor) under the website directory, and then control the entire website server, thereby achieving malicious data theft and causing large-scale damage. Therefore, the detection of Webshell has become an essential part of protecting network security. At present, the traditional detection method of Webshell includes feature detection or rule library matching. Such detection methods need to adapt to the development and transformation of Webshell and are in a passive position, and are powerless against new variants or anti-virus Webshell. Moreover, each major security company or manufacturer has its own Webshell feature library or rule library, and does not share resources, which results in a small coverage. SUMMARY

[0003] Therefore, the present application provides a Webshell file detection method, device, equipment and storage medium to solve the problem of small coverage and low detection initiative of the commonly used Webshell detection in the prior art.

[0004] In one aspect of the present application, a Webshell file detection method is provided, which comprises:

[0005] Obtaining the current operation mode of the server and the source file to which the operation request corresponding to the operation mode belongs;

[0006] Updating the value of the judgment parameter N according to the operation mode and the preset parameter update condition;

[0007] Wherein, N is a constant greater than or equal to 0;

[0008] In the case where N is greater than the preset value, the source file is determined to be a Webshell file.

[0009] In an exemplary embodiment of the present application, the above-mentioned updating the value of the judgment parameter N according to the operation mode and the preset parameter update condition can include:

[0010] In the case where the operation mode meets the preset parameter update condition, the sum of the current judgment parameter N value and the weight value M corresponding to the operation mode is determined, and the sum is determined as the updated value of the judgment parameter N;

[0011] In a case where the operation mode does not satisfy the preset parameter updating condition, the value of the judgment parameter N is kept unchanged;

[0012] The preset parameter updating condition includes that the operation mode corresponds to a suspicious operation mode, and the operation mode is different from all operation modes in a preset time period, and M is a constant greater than 0.

[0013] Further, the operation mode corresponding to the suspicious operation mode includes that a nobody user starts a bash process, or a middleware user starts a cmd process.

[0014] In an exemplary embodiment of the present application, the operation mode corresponding to the suspicious operation mode includes that an Internet Protocol Address (IP address) accesses a file that has never been accessed and returns a status of 200, the IP address is a sending address of a Hyper Transfer Protocol (HTTP) request, and the HTTP request carries an encryption parameter.

[0015] In another exemplary embodiment of the present application, the operation mode corresponding to the suspicious operation mode includes connecting a database by using a method other than an Application Programming Interface (API).

[0016] In another exemplary embodiment of the present application, the operation mode corresponding to the suspicious operation mode includes that a POST request accesses a first type folder, and the proportion of the POST request in all requests accessing the first type folder is greater than a first preset proportion.

[0017] The first type folder is a folder updated in a preset time, and the proportion of a script file in the first type folder does not exceed a second preset proportion, and other files in the first type folder are uniform suffix files.

[0018] In another exemplary embodiment of the present application, the operation mode corresponding to the suspicious operation mode includes that the access mode of any file satisfies at least one of the following conditions:

[0019] The frequency of access of any file by a fixed IP address exceeds a first preset value.

[0020] The total access times of a page corresponding to any file are less than a second preset value.

[0021] In access requests corresponding to any file, the proportion of a POST request in a GET request does not exceed a third preset proportion, and the return status is 200.

[0022] Any file corresponding to the page is an isolated page.

[0023] In another aspect of the present application, a Webshell file detection device is provided, which comprises:

[0024] An acquisition module is configured to acquire an operation mode of the current operation on the server and a source file to which an operation request corresponding to the operation mode belongs;

[0025] An updating module is configured to update a value of a judgment parameter N according to the operation mode and a preset parameter updating condition;

[0026] wherein N is a constant greater than or equal to 0;

[0027] A determination module is configured to determine that the source file is a Webshell file when N is greater than a preset value.

[0028] In another aspect of the present application, an electronic device is provided, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the program, a Webshell file detection method provided by any embodiment of the present application is implemented.

[0029] In another aspect of the present application, a non-transitory computer readable storage medium is provided, characterized in that the non-transitory computer readable storage medium stores a program or instructions, and the program or instructions cause a computer to execute steps of a Webshell file detection method provided by any embodiment of the present application.

[0030] The embodiments of the present application provide a Webshell file detection method, device, equipment and storage medium, wherein the method comprises: acquiring an operation mode of the current operation on the server and a source file to which an operation request corresponding to the operation mode belongs; updating a value of a judgment parameter N according to the operation mode and a preset parameter updating condition; wherein N is a constant greater than 0; and determining that the source file is a Webshell file when N is greater than a preset value. In the above scheme, since the preset parameter updating condition includes a judgment on the operation mode being a suspicious operation mode, and each suspicious operation mode corresponds to a weight value M, the updating value of the judgment parameter N can be determined based on the operation mode of the current operation on the server and the preset parameter updating condition. If the value of N is greater than the preset value, it is considered that the operation mode of the source file for operating the server multiple times is suspicious. Thus, the source file can be determined to be a Webshell file without detecting the specific content of the file, which not only avoids the possibility that an attacker avoids detection by the protection system through rules, but also has accurate and comprehensive detection capability for variant or updated Webshell files. BRIEF DESCRIPTION OF DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced as follows. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of these drawings.

[0032] Figure 1 A flowchart of a Webshell file detection method provided by an embodiment of the present application;

[0033] Figure 2 A structural schematic diagram of a Webshell file detection device provided by an embodiment of the present application;

[0034] Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0035] The embodiments of the present application will be described in detail below with reference to the drawings.

[0036] It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict; and all other embodiments obtained by those skilled in the art on the basis of the embodiments in the present disclosure without creative labor belong to the protection scope of the present disclosure.

[0037] It should be noted that the various aspects of the embodiments described below are within the scope of the appended claims. It should be apparent that the aspects described herein can be embodied in a wide variety of forms and that any specific structure and / or function described herein is merely illustrative. Based on the teachings provided herein one skilled in the art should appreciate that an aspect described herein can be implemented independently of any other aspects and that an aspect can be implemented both as any number of devices and / or as any number of methods. For example, an aspect can be implemented as a device that comprises any number of the features described herein. Additionally, an aspect can be implemented as any number of methods comprising any number of the features described herein. Additionally, one skilled in the art will appreciate that an aspect as described herein can be implemented as any number of software running on any number of hardware (e.g., object code or source code) and / or any number of hardware as described herein (e.g., integrated circuits).

[0038] In addition, in the embodiments of the present application, the words such as "optionally", "exemplarily" and the like are used to mean as an example, illustration or description. Any embodiment or design scheme described as "optionally" or "exemplarily" in the embodiments of the present application should not be interpreted as more preferred or more advantageous than other embodiments or design schemes. Rather, the words such as "optionally" or "exemplarily" are intended to present the relevant concept in a specific manner.

[0039] In order to facilitate a clearer understanding of the scheme provided by the embodiments of the present application, the related concepts involved in the embodiments of the present application are further explained in detail.

[0040] Webshell: a code execution environment in the form of a web page file such as an Active Server Page (asp), a Hypertext Preprocessor (PHP), a Java Server Page (jsp), or a Common Gateway Interface (cgi), mainly used for website management, server management, and permission management. It is currently mainly used as an attacker's backdoor program to control a website server.

[0041] In the existing scenario, a website attacker usually writes a Webshell on a server using a certain vulnerability to maliciously control the server, such as uploading other malicious tools or viewing and downloading data on the server, that is, the operations of adding, deleting, modifying, and inquiring.

[0042] To address the problems in the above scenario, the embodiments of the present application provide a flowchart of a Webshell file detection method, as shown in Figure 1 The method can determine and detect whether a related file is a Webshell file based on the current operation mode of the server, without detecting the specific content of the file, thereby avoiding the disadvantages of regular matching in the traditional detection method. The method can be executed by a Webshell file detection device provided by the embodiments of the present application, and the device can be implemented in software and / or hardware. In a specific embodiment, the device can be integrated in an electronic device, such as a server, a personal computer, and the like. The following embodiments will be described by taking the device integrated in an electronic device as an example, as shown in Figure 1 The method can include, but is not limited to, the following steps:

[0043] S101, obtaining the current operation mode of the server and a source file to which an operation request corresponding to the operation mode belongs.

[0044] Exemplarily, the operation mode of the server in the above steps can include modifying data, downloading data, uploading files, and the like. It can be understood that each operation on the server needs to request an instruction execution accordingly, which can be issued by a webshell file newly created by the attacker, or can be issued by a modified file after the attacker modifies a certain normal original file and writes an attack script. Therefore, in the above steps, the operation mode can correspond to a source file of an operation request, which can be a webshell file newly created by the attacker, or can be a file obtained by modifying a certain normal original file.

[0045] S102, updating the value of the judgment parameter N according to the operation mode and the preset parameter updating condition.

[0046] Optionally, the value of the judgment parameter N can be updated in the following manner: in the case that the operation mode meets the preset parameter updating condition, the sum of the current value of the judgment parameter N and the weight value M corresponding to the operation mode is determined, and the sum is determined as the updated value of the judgment parameter N. Wherein, N is a constant greater than or equal to 0, and M is a constant greater than 0. Of course, if the operation mode does not meet the preset parameter updating condition, the value of the judgment parameter N is updated to the original value, that is, the value of N remains unchanged.

[0047] Exemplarily, the preset parameter updating condition can include that the operation mode meets the corresponding suspicious operation mode, and the operation mode is different from all operation modes in a preset time period. That is, in the embodiment of the present application, each suspicious operation mode has its corresponding weight value M.

[0048] Further, in the embodiment of the present application, the weight values corresponding to each suspicious operation mode can be the same or different. For example, assuming that the suspicious operation modes include database connection suspicious, log recording suspicious, and the like, the corresponding weight values M can be assigned to different suspicious operation modes according to actual conditions. For example, the importance of the database connection suspicious and the log recording suspicious to the server is the same, so the weight values M corresponding to the database connection suspicious and the log recording suspicious can be set to 1. Of course, the weight values can also be decimals, which are not limited in the embodiment of the present application.

[0049] In addition, in the preset parameter updating condition, the current operation mode on the server is set to be different from all operation modes in the preset time period, which can effectively reduce the probability of false updating of the judgment parameter N. For example, assuming that the data writing operation on the server is a normal access operation, if the data is normally written on the server for several times, and one of the operations is misjudged as a suspicious operation mode, the subsequent several normal data writing operations will also be judged as suspicious operation modes. In this way, the value of the judgment parameter N needs to be updated for several times. However, in the embodiment of the present application, the condition that the current operation mode on the server is different from all operation modes in the last time period is set. For the same misjudgment condition, the value of the judgment parameter N is updated at most once, thereby greatly reducing the probability of false updating of the judgment parameter N.

[0050] In a case where N is greater than the preset value, it is determined that the source file is a Webshell file.

[0051] In the embodiment of the present application, the preset value can be set according to actual conditions. In a case where the value of N is greater than the preset value, it is indicated that the operation mode on the server has been determined to be a suspicious operation mode for a plurality of times, and the plurality of suspicious operation modes are different types of operation modes. Therefore, the source file corresponding to the operation request of the current operation mode on the server can be determined to be a Webshell file, that is, it is considered that an attacker performs malicious operation on the server through the Webshell file.

[0052] Optionally, in a case where it is determined that the source file is a Webshell file, the directory path of the Webshell file can also be output, which facilitates manual intervention for investigation.

[0053] The embodiment of the present application provides a Webshell file detection method, which comprises the following steps: obtaining an operation mode on a server and a source file corresponding to an operation request of the operation mode; updating a value of a judgment parameter N according to the operation mode and a preset parameter updating condition; wherein N is a constant greater than 0; and in a case where N is greater than a preset value, determining that the source file is a Webshell file. In the above scheme, since the preset parameter updating condition includes the judgment of the operation mode being a suspicious operation mode, and each suspicious operation mode corresponds to a weight value M, the updated value of the judgment parameter N can be determined based on the current operation mode on the server and the preset parameter updating condition. If the value of N is greater than the preset value, it is considered that the operation mode of the server through the source file is a suspicious operation mode. In this way, the source file can be determined to be a Webshell file without detecting the specific content of the file, which not only avoids the possibility that an attacker avoids the detection of the protection system through rules, but also has accurate and comprehensive detection capability for mutated or updated Webshell files.

[0054] The above operation mode is described in detail below by a specific embodiment. For example, in the embodiment of the present application, the operation mode of the current server can be determined as a suspicious operation mode from the aspects of processes, HTTP requests, database connections, files, logs, etc.

[0055] For example, from the perspective of process monitoring and judgment, if it is detected that the nobody user starts a bash process under the Linux operating system, or it is detected that the middleware user starts a cmd process under the Windows operating system, it is considered that the server is accessed through a Webshell file at this time.

[0056] From the perspective of HTTP request detection, if it is detected that an IP address accesses a file that has never been accessed before and the return status is 200, it is considered that the server is accessed through a Webshell file, wherein the IP address is the sending address of the HTTP request, and the HTTP request carries an encrypted parameter.

[0057] It can be understood that generally all database operations of a normal website are accessed through a unified API interface, so when detecting from the perspective of database connection, if it is determined that a script file connects and operates a database in a way other than API, it is considered that it is very likely that a hacker tries to connect the database through a Webshell file, and accordingly the file is determined as a Webshell file.

[0058] From the perspective of file monitoring, if there is a POST request accessing a first type of folder, and the proportion of the POST request in all requests accessing the first type of folder is greater than a first preset proportion, it is considered that the server is accessed through a Webshell file. The first type of folder is a folder updated within a preset time, for example, a file created (such as a new Webshell file) or modified (such as writing a Webshell in a normal file) within the last 7 days, the proportion of script files in the first type of folder does not exceed a second preset proportion, and the files other than script files in the first type of folder are uniform suffix files. That is, it can be understood that there are only a small number of script files, and other files are pictures or other uniform suffix files.

[0059] From the perspective of log monitoring, if the operation mode of the server satisfies at least one of the following, it is considered that the server is possibly accessed through a Webshell file.

[0060] For example, any file is accessed by a fixed IP address more than a first preset value;

[0061] The total access times of any file corresponding page is less than a second preset value;

[0062] In the access request corresponding to any file, the proportion of POST request in GET request is not more than a third preset proportion, and the return state is 200.

[0063] The page corresponding to any file is an isolated page, that is, the interaction with other pages is less than a preset value.

[0064] In the embodiment of the application, the initial value of N can be set to 0. Since the hacker will generate corresponding network behavior when maliciously controlling the server through the Webshell file, if the above several different monitoring methods are used to monitor the access operation mode of the server, it is determined that the operation mode is a suspicious operation mode, then the value of N can be updated in combination with the weight value M corresponding to different suspicious operation modes, and when the value of N is greater than a preset value, it is determined that the source file of the server is a Webshell file, and the directory path of the Webshell file is output. In this way, the operation and maintenance personnel can discover and intervene in the investigation in time, and prevent the network asset from suffering greater attack and loss.

[0065] In addition, although the steps of the method in the present disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. In addition or alternatively, some steps can be omitted, a plurality of steps can be combined into one step, and / or one step can be divided into a plurality of steps, etc.

[0066] Figure 2 A Webshell file detection device provided in the embodiment of the application, as shown in Figure 2 The device can include an acquisition module 201, an update module 202, and a determination module 203.

[0067] The acquisition module is configured to acquire the operation mode of the current server and the source file to which the operation request corresponding to the operation mode belongs.

[0068] The update module is configured to update the value of the judgment parameter N according to the operation mode and the preset parameter update condition.

[0069] N is a constant greater than or equal to 0.

[0070] The determination module is configured to determine that the source file is a Webshell file when the value of N is greater than a preset value.

[0071] In an example, the updating module is configured to determine a sum of the value of the current judgment parameter N and the weight value M corresponding to the operation mode, and determine the sum as the updated value of the judgment parameter N, when the operation mode meets the preset parameter updating condition; or keep the value of the judgment parameter N unchanged, when the operation mode does not meet the preset parameter updating condition.

[0072] The preset parameter updating condition includes that the operation mode is consistent with the corresponding suspicious operation mode, and the operation mode is different from all operation modes in a preset time period, and M is a constant greater than 0.

[0073] In an example, the operation mode consistent with the corresponding suspicious operation mode includes that nobody user starts a bash process, or middleware user starts a cmd process.

[0074] In an example, the operation mode consistent with the corresponding suspicious operation mode includes that an IP address accesses a file that has never been accessed before and the return state is 200, the IP address is the sending address of the HTTP request, and the HTTP request carries an encryption parameter.

[0075] In an example, the operation mode consistent with the corresponding suspicious operation mode includes connecting to a database in a manner other than API.

[0076] In an example, the operation mode consistent with the corresponding suspicious operation mode includes that a POST request accesses a first type of folder, and the proportion of the POST request in the request for accessing the first type of folder is greater than a first preset proportion.

[0077] The first type of folder is a folder updated in a preset time, and the proportion of script files in the first type of folder does not exceed a second preset proportion, and the files other than script files in the first type of folder are uniform suffix files.

[0078] In an example, the operation mode consistent with the corresponding suspicious operation mode includes that the access mode of any file meets at least one of the following conditions:

[0079] The frequency of access of any file by a fixed IP address exceeds a first preset value;

[0080] The total access times of the corresponding page of any file are less than a second preset value;

[0081] In the access request corresponding to any file, the proportion of the POST request in the GET request does not exceed a third preset proportion, and the return state is 200;

[0082] The page corresponding to any file is an isolated page.

[0083] The above-mentioned Webshell file detection device can performFigure 1 The provided Webshell file detection method has corresponding devices and beneficial effects.

[0084] Those skilled in the art can understand that various aspects of the present application can be implemented as a system, a method or a program product. Therefore, various aspects of the present application can be embodied as a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0085] Figure 3 A structural schematic diagram of an electronic device provided by an embodiment of the present application is shown in FIG. 1, which includes a controller 301, a memory 302, an input device 303, and an output device 304. The number of controllers 301 in the electronic device can be one or more. Figure 3 The number of controllers 301 in the electronic device can be one or more. Figure 3 The controller 301 in the electronic device is taken as an example in the embodiment. The controller 301, the memory 302, the input device 303, and the output device 304 in the electronic device can be connected through a bus or other means. Figure 3 The controller 301 in the electronic device is taken as an example in the embodiment. The controller 301, the memory 302, the input device 303, and the output device 304 in the electronic device can be connected through a bus or other means.

[0086] The memory 302 is a computer-readable storage medium, which can be used to store software programs, computer executable programs, and units, such as the Webshell file detection method in the embodiment. Figure 1 The controller 301 runs the software programs, instructions, and modules stored in the memory 302, thereby performing various functions and data processing of the electronic device, i.e., implementing the above-mentioned Webshell file detection method.

[0087] The memory 302 can mainly include a program storage area and a data storage area. The program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the computer, etc. In addition, the memory 302 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state memory device. In some examples, the memory 302 can further include a memory remotely arranged with respect to the controller 301, which can be connected to the terminal / server through a network. Examples of the above-mentioned network include but are not limited to the Internet, an enterprise intranet, a local area network, a mobile communication network, and a combination thereof.

[0088] The input device 303 can be used to receive input of digital or character information, and to generate key signal input relating to user settings of the electronic device and function control. The output device 303 can include a display device such as a display screen.

[0089] The electronic device according to this embodiment of the present application. The electronic device is merely an example and should not bring any limitation to the function and use range of the embodiments of the present application.

[0090] The electronic device is in the form of a general computing device. The components of the electronic device can include, but are not limited to, the at least one processor described above, the at least one memory described above, and a bus connecting different system components, including the memory and the processor.

[0091] The memory stores program codes which can be executed by the processor, so that the processor performs the steps described in the above "Exemplary Method" section according to various exemplary embodiments of the present application.

[0092] The memory can include a readable medium in the form of a volatile memory, such as a random access memory (RAM) and / or a cache memory, and can further include a read-only memory (ROM).

[0093] The memory can further include programs / utilities with a set of (at least one) program modules, such as an operating system, one or more application programs, other program modules, and program data, each of which or some combination of which can include implementation of a network environment.

[0094] The bus can be one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures.

[0095] The electronic device can also communicate with one or more external devices such as a keyboard or a pointing device, through an I / O interface. The electronic device can also communicate to one or more devices that enable a user to interact with it, and / or to one or more devices (e.g., a router, a modem, a server, etc.) that enable the electronic device to communicate with one or more other computing devices. Such communication can occur via an I / O interface. Also, the electronic device can communicate to one or more networks such as a local area network (LAN), a wide area network (WAN), and / or the Internet through a network adapter. It should be appreciated that the network adapter can be collectively part of the electronic device, part of another device, or a stand-alone device. In addition, while the network adapter is illustrated as a single device, the network adapter can include any number of devices that are adapted to enable the electronic device to communicate with one or more networks.

[0096] From the above description of the embodiments, it is easy for those skilled in the art to understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a U disk, a mobile hard disk, etc.) or a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.

[0097] In the example embodiments of the present disclosure, a computer-readable storage medium having a program product stored thereon capable of implementing the method described above is also provided. In some possible embodiments, various aspects of the present application can also be implemented in the form of a program product, which includes program code for causing an end device to perform the steps described in the "Example Method" section above according to various example embodiments of the present application when the program product is run on the end device.

[0098] The program product can employ any combination of one or more readable media. The readable medium can be a readable signal medium or a readable storage medium. The readable storage medium, for example, can be, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any combination thereof. More specific examples (a non-exhaustive list) of the readable storage medium include an electrical connection having one or more wires, a portable disc, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0099] Computer readable signal media can include a propagated data signal with instructions embodied in data signals. Such propagated signal can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, and so forth. Such computer readable storage media further includes any tangible storage media that is not yet in use by a brain of an entity.

[0100] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0101] Program code, used by or in connection with the routines described herein, can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider. The application is not limited to a particular programming language. The program code can be transmitted using any programmed medium, including transmission through a wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0102] Moreover, the above-described diagrams merely illustrate a possible implementation of a method according to an example embodiment of the application and are not intended to limit the application. It is readily appreciated that the processes depicted in the above-described diagrams do not imply or represent any required order among or between the processes. Additionally, it is readily appreciated that the processes can be executed synchronously or asynchronously, for example, in multiple modules.

[0103] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, such a division is not mandatory. Indeed, according to an implementation of the present disclosure, the features and functionalities of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functionalities of one module or unit described above can be further divided into several modules or units embodied.

[0104] The above merely provides the specific implementation of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed by the present application can be easily conceived by the person skilled in the art, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A Webshell file detection method, characterized in that, The method comprises: obtaining an operation mode of the current operation on the server and a source file to which an operation request corresponding to the operation mode belongs; updating a value of a judgment parameter N according to the operation mode and a preset parameter update condition; wherein N is a constant greater than or equal to 0; in the case where the N is greater than a preset value, determining that the source file is a Webshell file; wherein the updating of the value of the judgment parameter N according to the operation mode and the preset parameter update condition comprises: in the case where the operation mode meets the preset parameter update condition, determining a sum of the value of the current judgment parameter N and a weight value M corresponding to the operation mode, and determining the sum as an updated value of the judgment parameter N; in the case where the operation mode does not meet the preset parameter update condition, keeping the value of the judgment parameter N unchanged; wherein the preset parameter update condition comprises that the operation mode meets a corresponding suspicious operation mode, and the operation mode of the current operation on the server is different from all operation modes in a preset time period, and M is a constant greater than 0.

2. The method of claim 1, wherein, The operation mode meeting the corresponding suspicious operation mode comprises that a nobody user starts a bash process, or a middleware user starts a cmd process.

3. The method of claim 1, wherein, The operation mode meeting the corresponding suspicious operation mode comprises that an Internet Protocol (IP) address accesses a file that has never been accessed and returns a status of 200, the IP address is a sending address of a HyperText Transfer Protocol (HTTP) request, and the HTTP request carries an encryption parameter.

4. The method of claim 1, wherein, The operation mode meeting the corresponding suspicious operation mode comprises connecting a database in a manner other than an Application Programming Interface (API).

5. The method of claim 1, wherein, The operation mode meeting the corresponding suspicious operation mode comprises that a POST request accesses a first type of folder, and a proportion of the POST request in all requests for accessing the first type of folder is greater than a first preset proportion. Wherein the first type of folder is a folder updated in a preset time, and a proportion of script files in the first type of folder does not exceed a second preset proportion, and other files in the first type of folder except the script files are uniform suffix files.

6. The method of claim 1, wherein, The operation mode meeting the corresponding suspicious operation mode comprises that an access mode of any file meets at least one of the following: a frequency of the any file being accessed by a fixed IP address exceeds a first preset value; a total number of accesses of a page corresponding to the any file is less than a second preset value; in access requests corresponding to the any file, a proportion of POST requests in GET requests does not exceed a third preset proportion, and a return status is 200; the page corresponding to the any file is an isolated page.

7. A Webshell file detection apparatus, characterized by comprising: comprises: an obtaining module configured to obtain an operation mode of the current operation on the server and a source file to which an operation request corresponding to the operation mode belongs; an updating module configured to update a value of a judgment parameter N according to the operation mode and a preset parameter update condition; wherein N is a constant greater than or equal to 0; a determining module configured to determine, in the case where the N is greater than a preset value, that the source file is a Webshell file; The updating the value of the judgment parameter N according to the operation mode and a preset parameter updating condition comprises: In the case that the operation mode meets the preset parameter updating condition, determining a sum of the value of the current judgment parameter N and a weight value M corresponding to the operation mode, and determining the sum as an updated value of the judgment parameter N; In the case that the operation mode does not meet the preset parameter updating condition, keeping the value of the judgment parameter N unchanged; The preset parameter updating condition comprises that the operation mode is consistent with a corresponding suspicious operation mode, and the current operation mode to the server is different from all operation modes in a preset time period, and M is a constant greater than 0.

8. An electronic device, comprising: comprise a processor and a memory; The processor is configured to execute the steps of the Webshell file detection method according to any one of claims 1 to 6 by calling programs or instructions stored in the memory.

9. A non-transitory computer-readable storage medium, comprising: The non-transitory computer-readable storage medium stores programs or instructions, and the programs or instructions enable a computer to execute the steps of the Webshell file detection method according to any one of claims 1 to 6.

Images