Methods, devices and equipment for detecting toxic substances

Abstract

This application provides a method, apparatus, and device for detecting malicious code injection, relating to the field of network security. The method includes: in response to receiving a malicious code injection detection request, acquiring an access request and a first request response received by the system under test at the current moment; performing traffic mirroring processing on the access request to obtain a mirrored request corresponding to the access request; inputting the mirrored request to an initial system to obtain a second request response output by the initial system based on the mirrored request; wherein the initial system is the system obtained by mirroring the system under test at the initial moment; and determining the detection result of the system under test at the current moment based on the first and second request responses. Compared to methods that use a database storing abnormal code for source code comparison, the method provided in this embodiment can detect abnormal code not maintained in the database, effectively avoiding blind spots in malicious code injection detection caused by zero-day vulnerabilities.

Description

Technical Field

[0001] This application relates to the field of cybersecurity, and in particular to a method, apparatus, and device for detecting malware. Background Technology

[0002] With the continuous development of internet technology, people's lives, work, and studies are inseparable from the internet. However, there are currently various phenomena where malicious redirection redirects users to other pages, preventing them from accessing the content they need or causing them to download Trojan viruses and lose their data. These phenomena are generally referred to as malware injection.

[0003] Currently, when detecting malware in a system, the system source code is usually compared with the database storing malicious code to detect malware in a timely manner.

[0004] However, the above-mentioned methods for detecting malware require the maintenance of a database containing malicious code, but some malicious code may still fail to be collected into the database, leading to inaccurate malware detection results. Summary of the Invention

[0005] The method, apparatus, and equipment for detecting malicious code provided in this application are intended to solve the problem of inaccurate detection results caused by malicious code storage databases in related technologies.

[0006] Firstly, this application provides a method for detecting malware, including:

[0007] In response to receiving a malware detection request, the system obtains the access request and the first request response received by the system under test at the current moment, wherein the first request response is the response data output by the system under test at the current moment based on the access request;

[0008] Perform traffic mirroring on the access request to obtain the mirrored request corresponding to the access request;

[0009] The mirroring request is input to the initial system, and a second request response is output by the initial system based on the mirroring request; wherein, the initial system is the system obtained by mirroring the system under test at the initial time.

[0010] Based on the first request response and the second request response, the detection result of the system under test at the current moment is determined, and the detection result is used to characterize whether the system under test at the current moment is infected with malware.

[0011] In one possible implementation, determining the detection result of the system under test at the current moment based on the first request response and the second request response includes:

[0012] Based on the first request response and the preset model, anomaly detection is performed on the first request response to determine a first anomaly result; the preset model is used to detect abnormal data; the first anomaly result is used to indicate abnormal data in the first request response.

[0013] Based on the second request response and the preset model, anomaly detection is performed on the second request response to determine a second anomaly result; the second anomaly result is used to indicate abnormal data in the second request response.

[0014] Based on the first abnormal result and the second abnormal result, the detection result of the system under test at the current moment is determined.

[0015] In one possible implementation, determining the detection result of the system under test at the current moment based on the first abnormal result and the second abnormal result includes:

[0016] If it is determined that the number of abnormal data indicated by the second abnormal result is different from the number of abnormal data indicated by the first abnormal result, then it is determined that the system under test at the current moment has been compromised.

[0017] In one possible implementation, based on the first request response and a preset model, anomaly detection is performed on the first request response to determine a first anomaly result, including:

[0018] Based on the preset tag fields, feature extraction processing is performed on the first request response to obtain the first extracted information;

[0019] The first extracted information is input into the preset model to determine the first abnormal result.

[0020] In one possible implementation, inputting the first extracted information into the preset model to determine the first abnormal result includes:

[0021] The first extracted information is input into the preset model to obtain the prediction result output by the preset model. The prediction result is used to indicate the anomaly score of the data contained in the first extracted information, and the anomaly score is used to indicate the probability that the data is abnormal data.

[0022] If it is determined that the abnormal score of the data in the first extracted information is greater than a preset value, then the data is determined to be abnormal data; and the abnormal data is determined to be the first abnormal result.

[0023] In one possible implementation, the preset model is an isolated forest model.

[0024] In one possible implementation, the method further includes:

[0025] If the detection result is determined to indicate that the system under test is compromised at the current time, a warning message is issued to prompt the user to modify the system under test at the current time.

[0026] In one possible implementation, the method further includes:

[0027] Determine the deployment information of the system under test at the initial time, the deployment information including: the code information of the system under test at the initial time, the operating system information of the system under test at the initial time, and the database information that the system under test is connected to at the initial time;

[0028] Based on the deployment information, the system under test at the initial moment is mirrored to obtain the initial system.

[0029] Secondly, this application provides a device for detecting malware, comprising:

[0030] The acquisition unit is used to, in response to receiving a malware detection request, acquire the access request and the first request response received by the system under test at the current moment, wherein the first request response is the response data output by the system under test at the current moment based on the access request;

[0031] The first processing unit is used to perform traffic mirroring on the access request to obtain the mirrored request corresponding to the access request.

[0032] The second processing unit is used to input the mirroring request to the initial system and obtain a second request response output by the initial system based on the mirroring request; wherein, the initial system is the system obtained by mirroring the system under test at the initial time.

[0033] The first determining unit is configured to determine the detection result of the system under test at the current time based on the first request response and the second request response, wherein the detection result is used to characterize whether the system under test at the current time is infected with malware.

[0034] In one possible implementation, the first determining unit includes:

[0035] The first detection module is used to perform anomaly detection on the first request response based on the first request response and a preset model, and determine a first anomaly result; the preset model is used to perform anomaly data detection; the first anomaly result is used to indicate the anomaly data in the first request response.

[0036] The second detection module is used to perform anomaly detection on the second request response based on the second request response and the preset model, and determine a second anomaly result; the second anomaly result is used to indicate abnormal data in the second request response;

[0037] The determination module is used to determine the detection result of the system under test at the current time based on the first abnormal result and the second abnormal result.

[0038] In one possible implementation, a module is defined, specifically for:

[0039] If it is determined that the number of abnormal data indicated by the second abnormal result is different from the number of abnormal data indicated by the first abnormal result, then it is determined that the system under test at the current moment has been compromised.

[0040] In one possible implementation, the first detection module is specifically used for:

[0041] Based on the preset tag fields, feature extraction processing is performed on the first request response to obtain the first extracted information;

[0042] The first extracted information is input into the preset model to determine the first abnormal result.

[0043] In one possible implementation, the first detection module, when inputting the first extracted information into the preset model to determine the first abnormal result, is specifically used to input the first extracted information into the preset model to obtain a prediction result output by the preset model, wherein the prediction result is used to indicate the abnormal score of the data contained in the first extracted information, and the abnormal score is used to indicate the probability that the data is abnormal data; if it is determined that the abnormal score of the data in the first extracted information is greater than a preset value, then the data is determined to be abnormal data; and the abnormal data is determined to be the first abnormal result.

[0044] In one possible implementation, the preset model is an isolated forest model.

[0045] In one possible implementation, the device further includes:

[0046] An alarm unit is used to issue a warning message if it is determined that the detection result indicates that the system under test is infected with malware at the current time. The warning message is used to prompt the user to modify the system under test at the current time.

[0047] In one possible implementation, the device further includes:

[0048] The second determining unit is used to determine the deployment information of the system under test at the initial time. The deployment information includes: the code information of the system under test at the initial time, the operating system information of the system under test at the initial time, and the database information that the system under test is connected to at the initial time.

[0049] The third processing unit is used to perform mirroring processing on the system under test at the initial time according to the deployment information to obtain the initial system.

[0050] Thirdly, this application provides an electronic device, including: a memory and a processor;

[0051] Memory; memory for storing executable instructions of the processor;

[0052] The processor is configured to execute the method as described in any of the first aspects according to the executable instructions.

[0053] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.

[0054] Fifthly, this application provides a computer program product comprising a computer program that, when executed by a processor, implements the method described in any one of the first aspects.

[0055] This application provides a method, apparatus, and device for detecting malware. The method includes: in response to receiving a malware detection request, acquiring an access request and a first request response received by the system under test at the current moment, wherein the first request response is response data output by the system under test at the current moment based on the access request; performing traffic mirroring processing on the access request to obtain a mirrored request corresponding to the access request; inputting the mirrored request to an initial system to obtain a second request response output by the initial system based on the mirrored request; wherein the initial system is a system obtained by performing mirroring processing on the system under test at the initial moment; and determining a detection result of the system under test at the current moment based on the first request response and the second request response, wherein the detection result is used to characterize whether the system under test at the current moment is malware-infected. In the above method, the system under test receives an access request and performs mirroring processing to obtain a mirrored request. Then, the second request response obtained by the initial system under the mirrored request and the first request response obtained by the system under test at the current moment under the access request are compared to determine whether malware is infected in the current system under test. Understandably, compared to methods that use databases storing abnormal code for source code comparison, the method provided in this embodiment can detect abnormal code that is not maintained in the database, effectively avoiding blind spots in drive-by download detection caused by zero-day vulnerabilities, thus preventing inaccurate detection results. Furthermore, it can reduce the manual costs associated with maintaining the database. Attached Figure Description

[0056] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0057] Figure 1 A schematic flowchart illustrating a malware detection method provided in an embodiment of this application;

[0058] Figure 2 A scenario diagram provided for an embodiment of this application;

[0059] Figure 3 A flowchart illustrating another method for detecting malware provided in this application embodiment;

[0060] Figure 4 This application provides a schematic diagram of the structure of a device for detecting toxic substances;

[0061] Figure 5 This application provides a structural schematic diagram of yet another device for detecting tarpaulins.

[0062] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0063] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0064] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0065] Currently, with the development of internet technology, people often rely on it to obtain the information they need. However, some malicious malware exists that users cannot accurately identify, leading to data leaks when users visit such malicious websites. Common types of malware include frame malware, JavaScript file malware, JavaScript transformation encryption, body malware, hidden malware, CSS malware, Java malware, image spoofing, fake API calls, and advanced deception.

[0066] In one example, malware detection can be performed by matching the characteristics of the source code corresponding to the system at runtime with malicious code. However, this method requires continuous maintenance and updates to the database storing malicious code. Furthermore, malicious code that uses encryption, obfuscation, or complex methods to dynamically generate itself requires specialized analysis to extract its corresponding characteristics. Understandably, this method cannot detect malicious code not present in the database, leading to inaccurate detection results and a high false positive / false negative rate. Moreover, this method is also ineffective in detecting zero-day vulnerabilities—computer vulnerabilities that have not been discovered by security vendors but can be maliciously exploited.

[0067] In one example, monitoring the behavior of malware within a virtual machine honeypot can determine if a webpage has been compromised. Specifically, a real operating system can be installed in the virtual machine, and a browser can be used to browse the web. When a webpage containing embedded malicious code is accessed, the malicious program will automatically run, detecting the webpage's behavior. Based on the monitored system dynamics, it can be determined whether the client-side honeypot system has been attacked and infected with malware, thus confirming whether the webpage has been compromised. However, this method still requires continuous and regular maintenance of the browser and plugin versions within the virtual machine, which can easily lead to missed detections.

[0068] The method, apparatus, and equipment for detecting malware provided in this application are intended to solve at least one of the above-mentioned technical problems.

[0069] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0070] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0071] Figure 1 This is a flowchart illustrating a malware detection method provided in an embodiment of this application, as shown below. Figure 1 As shown, the method includes the following steps:

[0072] S101. In response to receiving a malware detection request, obtain the access request and the first request response received by the system under test at the current time, wherein the first request response is the response data output by the system under test based on the access request at the current time.

[0073] For example, the execution entity in this embodiment can be a malware detection device, which can be a processor, chip, electronic device, etc., and no specific limitation is made in this embodiment.

[0074] In this embodiment, the malware detection request can be understood as an instruction to perform malware detection on the current system under test. This malware detection request can be input manually through the input interface of the malware detection device, or it can be triggered periodically by the user by setting the malware detection cycle. In this embodiment, there are no specific restrictions on the method of generating the malware detection request.

[0075] Upon receiving a malware detection request, the malware detection device can obtain the access request received by the system under test at the current moment, and the first request response generated by the system under test after receiving the access request. For example, the first request response can be the page that the system under test is redirected to after receiving the access request, as well as the various elements and components contained in the page.

[0076] S102. Perform traffic mirroring on the access request to obtain the mirrored request corresponding to the access request.

[0077] For example, in this embodiment, after obtaining the access request, traffic mirroring processing is performed on the obtained access request. That is, the real traffic corresponding to the actual access request is copied and mirrored to obtain the mirrored request. It can be understood that the mirrored request obtained through traffic mirroring processing is the same request as the original real access request.

[0078] In one possible implementation, when performing traffic mirroring on the acquired access requests, if the number of access requests is large, the requests can be filtered before traffic mirroring is performed on the filtered requests, thereby reducing the processing resources required by the device. Meanwhile, the system under test will still respond to each received access request in real time to ensure that no user access needs are missed. Specifically, the specific principle of traffic mirroring in this embodiment is the same as that in related technologies, and will not be repeated here.

[0079] S103. Input the mirror request to the initial system and obtain the second request response output by the initial system based on the mirror request; wherein, the initial system is the system obtained by mirroring the system under test at the initial time.

[0080] For example, in this embodiment, an initial system corresponding to the system under test at the current moment is also pre-set. The initial system can be understood as a mirror system obtained by mirroring the initial configuration generation system when the system under test finishes initial configuration generation (i.e., at the initial moment). It can be understood that the mirror system in this embodiment can be regarded as the system corresponding to the system under test at the initial moment that has not been compromised. In practical applications, the mirror system can be configured in a virtual platform.

[0081] Once the image request is obtained through image processing, it can be forwarded to the initial system to obtain the second request response generated by the initial system in response to the image request.

[0082] S104. Based on the first request response and the second request response, determine the detection result of the system under test at the current moment. The detection result is used to characterize whether the system under test is infected with malware at the current moment.

[0083] For example, in this embodiment, after obtaining the first request response and the second request response, it can be determined whether the system under test is infected with malware at the current time based on the obtained first request response and second request response.

[0084] In one example, since the initial system can be understood as a mirror system of the system under test at the initial moment when there is no malware, if the system under test at the current moment is not malware-free, then the first request response and the second request response obtained under the same request (i.e., the aforementioned access request and mirror request) should be consistent. In other words, the presence of malware in the current system under test can be determined by comparing whether the first request response and the second request response are consistent.

[0085] In this embodiment, the received access requests to the system under test are mirrored to obtain mirrored requests. Then, the second request response received by the initial system under the mirrored request is compared with the first request response received by the system under test at the current moment under the access request to determine whether malware is present in the current system under test. It is understood that, compared to methods that use a database storing abnormal code for source code comparison, the method provided in this embodiment can detect abnormal code not maintained in the database, effectively avoiding blind spots in malware detection caused by zero-day vulnerabilities, thus preventing inaccurate detection results. Furthermore, it can reduce the manual costs of maintaining the database.

[0086] Figure 2 This is a schematic diagram of a scenario provided for an embodiment of this application. For example... Figure 2 As shown, the system includes a client, a traffic mirroring device, a system under test, and an initial system. The client can initiate access requests to the system under test. The traffic mirroring device performs traffic mirroring on the received access requests and sends the mirrored requests to the initial system, which then outputs a second request response corresponding to the mirrored request. Furthermore, the traffic mirroring device in this embodiment can also forward the received access requests to the system under test, which then outputs a first request response corresponding to the access request. Subsequently, by comparing and analyzing the first and second request responses, the malware detection result for the system under test is obtained.

[0087] Figure 3 This is a flowchart illustrating another malware detection method provided in an embodiment of this application, as shown below. Figure 3 As shown, the method includes the following steps:

[0088] S301. Determine the deployment information of the system under test at the initial moment. The deployment information includes: the code information of the system under test at the initial moment, the environment information of the system under test at the initial moment, and the database information that the system under test is connected to at the initial moment.

[0089] For example, in this embodiment, after the system under test has been developed and deployed, it can be image-processed to obtain an image system corresponding to the system under test in its initial state, i.e., the initial system. Specifically, when performing system image processing, the deployment information corresponding to the system under test at the initial moment can first be obtained.

[0090] For example, the deployment information in this embodiment may include:

[0091] The code information corresponding to the system under test at the initial moment, that is, the system source code corresponding to the system under test at the initial moment;

[0092] The environmental information of the system under test at the initial moment can be understood as the operating system, network parameter configuration, etc. deployed by the system under test. No specific restrictions are made in this application.

[0093] In addition, it may include the database information corresponding to the system under test at the initial moment, that is, the access configuration corresponding to the database that the system under test can access, such as database access interface address information, etc.

[0094] S302. Based on the deployment information, perform mirroring on the system under test at the initial moment to obtain the initial system.

[0095] For example, in this embodiment, after obtaining the above deployment information, the system under test at the initial moment can be imaged in the virtual platform according to the obtained deployment information to ensure that the initial system obtained by the image processing can fully back up the system under test at the initial moment, thereby ensuring the accuracy of subsequent malware detection.

[0096] S303. In response to receiving a malware detection request, obtain the access request and the first request response received by the system under test at the current moment, wherein the first request response is the response data output by the system under test based on the access request at the current moment.

[0097] S304. Perform traffic mirroring on the access request to obtain the mirrored request corresponding to the access request.

[0098] S305. Input the mirror request to the initial system and obtain the second request response output by the initial system based on the mirror request; wherein, the initial system is the system obtained by mirroring the system under test at the initial time.

[0099] For example, the specific principles of steps S303-S305 in this embodiment can be found in steps S101-S103, and will not be repeated here.

[0100] S306. Based on the first request response and the preset model, perform anomaly detection on the first request response to determine the first anomaly result; the preset model is used to perform anomaly data detection; the first anomaly result is used to indicate the anomaly data in the first request response.

[0101] For example, in this embodiment, when determining the malware detection result based on the first request response and the second request response, anomaly detection processing can first be performed on the first request response according to a preset model to determine the first abnormal result corresponding to the first request response. The first abnormal result indicates whether the first request response contains abnormal data, and if abnormal data is determined to exist, it can also indicate which part of the data in the first request response is abnormal data. Compared to normal data, the distribution area of ​​the characteristic distribution of abnormal data is sparser, meaning the probability of data falling within this distribution is low; therefore, data distributed in this area can be considered abnormal data.

[0102] In one example, when performing anomaly detection on the first request response, the first request response can be directly used as input to a preset model so that the preset model can determine whether it contains abnormal data.

[0103] In one possible implementation, the pre-set model can be a model constructed using the Isolation Forest algorithm. When constructing an isolated model using this algorithm, multiple user requests are first simulated and input into an initial system. The results from the initial system are then used as training data to train the Isolation Forest model. After obtaining the model, the first request response and the second request response are input into the Isolation Forest model respectively to obtain their respective model prediction results. The Isolation Forest algorithm chosen in this application, compared to other machine learning algorithms, does not require calculating a large amount of distance and density to partition the data, thus avoiding the consumption of device processing resources. Furthermore, the multiple binary trees obtained through training do not interfere with each other, which helps improve data processing efficiency.

[0104] In one example, step S306 can be achieved through the following steps:

[0105] The first step of step S306: Based on the preset label field, perform feature extraction processing on the first request response to obtain the first extracted information.

[0106] For example, in this embodiment, when determining the first abnormal result based on the first request response and the preset model, the first request response can first be processed by feature extraction, that is, by obtaining the data corresponding to the preset label field through the preset label field as the first extracted information.

[0107] For example, the preset tag fields can be at least one of the iframe field, javascript field, css field, and url field in the source code of the web page, so that key information in the web page can be extracted, that is, the first extracted information in the first request response.

[0108] The second step of step S306: Input the first extracted information into the preset model to determine the first abnormal result.

[0109] For example, after obtaining the first extracted information, the first extracted information can be directly used as the input of the preset model, and the first abnormal result corresponding to the first request response can be obtained based on the preset model.

[0110] It is understood that in this embodiment, after the first request response is obtained, feature extraction processing is first performed on the first request response to extract the associated information related to the page display, i.e., the aforementioned first extracted information. Furthermore, through the above feature extraction processing method, redundant data in the first request response can be reduced, which is beneficial to improving the detection accuracy of the subsequent preset model for abnormal data detection, reducing the device operating resources required for model processing, and improving processing efficiency.

[0111] In one example, the first step of step S306 can be achieved through the following steps:

[0112] "The first extracted information is input into the preset model to obtain the prediction result output by the preset model. The prediction result is used to indicate the abnormal score of the data contained in the first extracted information. The abnormal score is used to indicate the probability that the data is abnormal data. If it is determined that the abnormal score of the data in the first extracted information is greater than the preset value, the data is determined to be abnormal data. And the abnormal data is determined to be the first abnormal result."

[0113] For example, in this embodiment, after the first extracted information is input into the preset model, the preset model predicts the abnormal score value for each data contained in the first extracted information. The abnormal score value can be understood as the probability value that the data is identified as abnormal data. When the preset model determines the abnormal score value corresponding to the data contained in the first extracted information, it can then be determined whether the data is abnormal based on the magnitude of the abnormal score value predicted by the preset model for each data. Specifically, the abnormal score value can be compared with a preset value. If the abnormal score value is greater than the preset value, the data corresponding to that abnormal score value is identified as abnormal data. If the value corresponding to the abnormal score value is less than or equal to the preset value, the data corresponding to that abnormal score value can be identified as normal data. Through the comparison of the abnormal score and the preset value, the abnormal data obtained based on the abnormal score and the preset value is used as the first abnormal result corresponding to the first request response.

[0114] It is understood that the preset model in this embodiment can further filter out abnormal data contained in the first request response by predicting abnormal scores from the data in the first request response, so as to determine as soon as possible whether there is malware in the system under test.

[0115] S307. Based on the second request response and the preset model, perform anomaly detection on the second request response to determine the second anomaly result; the second anomaly result is used to indicate the abnormal data in the second request response.

[0116] For example, the implementation principle of this step can be found in the principle of processing the first request response in step S306. The two principles are the same, and will not be repeated here.

[0117] S308. Based on the first abnormal result and the second abnormal result, determine the detection result of the system under test at the current moment. The detection result is used to characterize whether the system under test is infected with malware at the current moment.

[0118] For example, after obtaining the first and second abnormal results, the abnormal data indicated by the first and second abnormal results can be compared. If the indicated abnormal data is the same, it is considered that there is no malware in the system under test at the current moment. If the abnormal data indicated by the first and second abnormal results are different, it is considered that there is malware in the system under test at the current moment.

[0119] It is understood that in this embodiment, during malware detection, a preset model can be used to detect abnormal data in the first request response and the second request response respectively, thereby filtering out abnormal data in the first and second request responses. By comparing the detected abnormal data, it can be determined whether malware is present. By detecting abnormal data in the request responses as described above, the amount of data that needs to be compared when comparing the first and second request responses can be reduced, thus improving comparison efficiency.

[0120] In one example, step S308 can be achieved by the following steps: if it is determined that the number of abnormal data indicated by the second abnormal result is different from the number of abnormal data indicated by the first abnormal result, then it is determined that the system under test at the current moment has been compromised.

[0121] For example, in this embodiment, when comparing the abnormal data in the first abnormal result and the abnormal data in the second abnormal result, the number of abnormal data contained in each can be compared first. If it is determined that the number of abnormal data contained in the two is different, it indicates that there is malware in the system under test at the current time.

[0122] That is, in obtaining the first and second abnormal results, the number of abnormal data contained in each abnormal result is first determined, and the number of data is compared to determine whether there is malware in the system under test.

[0123] In one possible scenario, if the number of outliers in both is the same, then the outliers in both can be compared one by one.

[0124] It is understandable that in this embodiment, when comparing the first abnormal result and the second abnormal result, the consistency between the two can be determined by comparing the number of abnormal data, thereby reducing the time required for subsequent data comparison.

[0125] S309. If the detection result is determined to indicate that the system under test is infected with malware at the current time, a warning message is issued to prompt the user to modify the system under test at the current time.

[0126] For example, in this embodiment, when it is determined through the above method that the system under test contains malware, a warning message can be issued to the user so that the user is promptly notified of the malware infection and can take timely action to remove it. In one example, when sending the warning message to the user, the message can be sent according to the communication method reserved by the user. It should be noted that this embodiment does not impose specific limitations on the method of sending the warning message.

[0127] It is understandable that in this embodiment, when a malicious code is detected in the system under test, an alarm message can be issued in a timely manner so that the user can be informed of the malicious code in the system in a timely manner and deal with the system vulnerability in a timely manner.

[0128] In this embodiment, during malware detection, a preset model can be used to detect abnormal data in the first and second request responses, respectively. This allows for the filtering of abnormal data in both responses, and by comparing the detected abnormal data, the presence of malware can be determined. Detecting abnormal data in the request responses reduces the amount of data that needs to be compared between the first and second responses, improving comparison efficiency. Furthermore, when comparing the first and second abnormal results, the number of abnormal data points can be compared to determine if they are consistent, reducing the time required for subsequent data comparisons. Moreover, after obtaining the first request response, feature extraction can be performed to extract relevant information associated with the page display, i.e., the aforementioned first extracted information. This feature extraction reduces redundant data in the first request response, improving the detection accuracy of the preset model for abnormal data detection, reducing the device resources required for model processing, and increasing processing efficiency.

[0129] Figure 4 This application provides a schematic diagram of the structure of a device for detecting toxic substances, as shown below. Figure 4 As shown, the device includes:

[0130] The acquisition unit 401 is used to, in response to receiving a malware detection request, acquire the access request and the first request response received by the system under test at the current time, wherein the first request response is the response data output by the system under test based on the access request at the current time.

[0131] The first processing unit 402 is used to perform traffic mirroring on the access request to obtain the mirrored request corresponding to the access request.

[0132] The second processing unit 403 is used to input the mirror request to the initial system and obtain the second request response output by the initial system based on the mirror request; wherein, the initial system is the system obtained by mirroring the system under test at the initial time.

[0133] The first determining unit 404 is used to determine the detection result of the system under test at the current time based on the first request response and the second request response. The detection result is used to characterize whether the system under test is infected with malware at the current time.

[0134] The apparatus provided in this embodiment is used to implement the technical solution provided by the above method. Its implementation principle and technical effect are similar, and will not be described again.

[0135] Figure 5 This application provides a structural schematic diagram of yet another device for detecting toxic substances, such as... Figure 5 As shown, in Figure 4 Based on the device structure shown, the first determining unit 404 in this embodiment includes:

[0136] The first detection module 4041 is used to perform anomaly detection on the first request response based on the first request response and the preset model, and determine the first anomaly result; the preset model is used to perform anomaly data detection; the first anomaly result is used to indicate the anomaly data in the first request response.

[0137] The second detection module 4042 is used to perform anomaly detection on the second request response based on the second request response and the preset model, and determine the second anomaly result; the second anomaly result is used to indicate the abnormal data in the second request response.

[0138] The determination module 4043 is used to determine the detection result of the system under test at the current time based on the first abnormal result and the second abnormal result.

[0139] In one possible implementation, module 4043 is specifically used for:

[0140] If it is determined that the number of abnormal data indicated by the second abnormal result is different from the number of abnormal data indicated by the first abnormal result, then it is determined that the system under test at the current moment has been compromised.

[0141] In one possible implementation, the first detection module 4043 is specifically used for:

[0142] Based on the preset label fields, feature extraction processing is performed on the first request response to obtain the first extracted information;

[0143] The first extracted information is input into the preset model to determine the first abnormal result.

[0144] In one possible implementation, the first detection module 4041, when inputting the first extracted information into a preset model to determine the first abnormal result, is specifically used to input the first extracted information into the preset model to obtain the prediction result output by the preset model. The prediction result is used to indicate the abnormal score of the data contained in the first extracted information, and the abnormal score is used to indicate the probability that the data is abnormal data. If it is determined that the abnormal score of the data in the first extracted information is greater than a preset value, then the data is determined to be abnormal data, and the abnormal data is determined to be the first abnormal result.

[0145] In one possible implementation, the default model is the isolated forest model.

[0146] In one possible implementation, the device further includes:

[0147] The alarm unit 405 is used to issue a warning message if it is determined that the detection result indicates that the system under test is infected with malware at the current time. The warning message is used to prompt the user to modify the system under test at the current time.

[0148] In one possible implementation, the device further includes:

[0149] The second determining unit 406 is used to determine the deployment information of the system under test at the initial time. The deployment information includes: the code information of the system under test at the initial time, the operating system information of the system under test at the initial time, and the database information that the system under test is connected to at the initial time.

[0150] The third processing unit 407 is used to perform mirroring processing on the system under test at the initial moment based on the deployment information to obtain the initial system.

[0151] The apparatus provided in this embodiment is used to implement the technical solution provided by the above method. Its implementation principle and technical effect are similar, and will not be described again.

[0152] This application provides an electronic device, including: a memory and a processor;

[0153] Memory; memory used to store processor-executable instructions;

[0154] The processor is used to execute methods according to executable instructions.

[0155] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, such as... Figure 6 As shown, the electronic device includes:

[0156] The electronic device includes a processor 291 and a memory 292; it may also include a communication interface 293 and a bus 294. The processor 291, memory 292, and communication interface 293 can communicate with each other via the bus 294. The communication interface 293 can be used for information transmission. The processor 291 can invoke logical instructions stored in the memory 292 to execute the methods of the above embodiments.

[0157] Furthermore, the logic instructions in the aforementioned memory 292 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium.

[0158] The memory 292, as a computer-readable storage medium, can be used to store software programs and computer-executable programs, such as program instructions / modules corresponding to the methods in the embodiments of this application. The processor 291 executes functional applications and data processing by running the software programs, instructions, and modules stored in the memory 292, thereby implementing the methods in the above-described method embodiments.

[0159] The memory 292 may include a program storage area and a data storage area. The program storage area may store the operating system and application programs required for at least one function; the data storage area may store data created based on the use of the terminal device. Furthermore, the memory 292 may include high-speed random access memory and may also include non-volatile memory.

[0160] This application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement any of the methods.

[0161] This application provides a computer program product, which includes a computer program that, when executed by a processor, implements any one of the methods.

[0162] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the appended claims.

[0163] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A horse-hitch detection method, characterized by, The method comprises: in response to receiving a horse detection request, obtaining an access request received by a to-be-tested system at a current time and a first request response, wherein the first request response is response data output by the to-be-tested system at the current time based on the access request; performing traffic mirroring processing on the access request to obtain a mirror request corresponding to the access request; inputting the mirror request into an initial system to obtain a second request response output by the initial system based on the mirror request; wherein the initial system is a system that has not been horse-mounted obtained by mirroring processing of the to-be-tested system at an initial time; determining a detection result of the to-be-tested system at the current time according to the first request response and the second request response, the detection result being used to represent whether the to-be-tested system at the current time is horse-mounted; The method further comprises: determining deployment information of the to-be-tested system at the initial time, the deployment information comprising: code information of the to-be-tested system at the initial time, operating system information in which the to-be-tested system at the initial time is located, and database information to which the to-be-tested system at the initial time is connected; performing mirroring processing on the to-be-tested system at the initial time according to the deployment information to obtain the initial system.

2. The method of claim 1, wherein, According to the first request response and the second request response, determining a detection result of the to-be-tested system at the current time comprises: performing abnormality detection on the first request response according to the first request response and a preset model to determine a first abnormality result; the preset model is used for abnormality data detection; the first abnormality result is used to indicate abnormal data in the first request response; performing abnormality detection on the second request response according to the second request response and the preset model to determine a second abnormality result; the second abnormality result is used to indicate abnormal data in the second request response; determining the detection result of the to-be-tested system at the current time according to the first abnormality result and the second abnormality result.

3. The method of claim 2, wherein, According to the first abnormality result and the second abnormality result, determining a detection result of the to-be-tested system at the current time comprises: if it is determined that the number of abnormal data indicated by the second abnormality result is greater than the number of abnormal data indicated by the first abnormality result, it is determined that the to-be-tested system at the current time is horse-mounted.

4. The method of claim 2, wherein, According to the first request response and a preset model, performing abnormality detection on the first request response to determine a first abnormality result comprises: performing feature extraction processing on the first request response according to a preset label field to obtain first extraction information; inputting the first extraction information into the preset model to determine the first abnormality result.

5. The method of claim 4, wherein, Inputting the first extraction information into the preset model to determine the first abnormality result comprises: inputting the first extraction information into the preset model to obtain a prediction result output by the preset model, wherein the prediction result is used to indicate an abnormal score value of data contained in the first extraction information, and the abnormal score value is used to indicate a probability that the data is abnormal data; If it is determined that the anomaly score value of the data in the first extraction information is greater than a preset value, the data is determined as abnormal data, and the abnormal data is determined as the first abnormal result.

6. The method of claim 2, wherein, The preset model is an isolation forest model.

7. The method of claim 1, wherein, The method further includes: If it is determined that the detection result indicates that the system under test at the current time has a horse, a warning information is sent, and the warning information is used to prompt a user to modify the system under test at the current time.

8. A horse collar detection device, characterized by Comprise: An acquisition unit is configured to, in response to receiving a horse detection request, acquire an access request received by a system under test at a current time and a first request response, wherein the first request response is response data output by the system under test at the current time based on the access request; A first processing unit is configured to perform traffic mirroring processing on the access request to obtain a mirror request corresponding to the access request; A second processing unit is configured to input the mirror request to an initial system to obtain a second request response output by the initial system based on the mirror request, wherein the initial system is a system obtained by performing mirroring processing on a system under test at an initial time; A first determination unit is configured to determine a detection result of the system under test at the current time according to the first request response and the second request response, and the detection result is used to indicate whether the system under test at the current time has a horse. The device further comprises: A second determination unit is configured to determine deployment information of the system under test at the initial time, and the deployment information comprises code information of the system under test at the initial time, operating system information in which the system under test at the initial time is located, and database information connected by the system under test at the initial time. A third processing unit is configured to perform mirroring processing on the system under test at the initial time according to the deployment information to obtain the initial system.

9. The apparatus of claim 8, wherein, The first determination unit comprises: A first detection module is configured to perform anomaly detection on the first request response according to the first request response and a preset model to determine a first abnormal result, wherein the preset model is used for anomaly data detection, and the first abnormal result is used to indicate abnormal data in the first request response; A second detection module is configured to perform anomaly detection on the second request response according to the second request response and the preset model to determine a second abnormal result, wherein the second abnormal result is used to indicate abnormal data in the second request response; A determination module is configured to determine a detection result of the system under test at the current time according to the first abnormal result and the second abnormal result.

10. The apparatus of claim 9, wherein, The determination module is specifically configured to: If it is determined that the number of abnormal data indicated by the second abnormal result is different from the number of abnormal data indicated by the first abnormal result, it is determined that the system under test at the current time has a horse.

11. The apparatus of claim 9, wherein, The first detection module is specifically configured to: Perform feature extraction processing on the first request response according to a preset label field to obtain first extraction information; Input the first extraction information into the preset model to determine the first abnormal result.

12. The apparatus of claim 11, wherein, The first detection module is specifically configured to input the first extracted information into the preset model to obtain a prediction result output by the preset model, when the first extracted information is input into the preset model to determine the first abnormal result, wherein the prediction result is used to indicate an abnormal score value of data contained in the first extracted information, and the abnormal score value is used to indicate a probability that the data is abnormal data; if it is determined that the abnormal score value of the data in the first extracted information is greater than a preset value, it is determined that the data is abnormal data; and the abnormal data is determined as the first abnormal result.

13. The apparatus of claim 9, wherein, The preset model is an isolation forest model.

14. The apparatus of claim 8, wherein, The device further includes: The alarm unit is configured to issue a warning information if it is determined that the detection result indicates that the to-be-tested system at the current time point is horse-matching, and the warning information is used to prompt a user to modify the to-be-tested system at the current time point.

15. An electronic device comprising: A processor and a memory connected with the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to implement the method in any one of claims 1-7.

16. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to implement the method in any one of claims 1-7. 17.A computer program product, comprising a computer program, which is executed by a processor to implement the method in any one of claims 1-7.

Images