Method and apparatus for determining file risk

Abstract

The application provides a method and device for determining file risk, the method comprising: obtaining a segmented message from a data file; determining a target character to be analyzed in the segmented message at a current time according to an order of characters in the segmented message and inputting the target character into a first state machine; if it is determined that the target character belongs to an effective code character in a website backdoor file based on a first current state of the first state machine and a character recognition rule corresponding to the first current state, inputting the target character into a second state machine; if it is determined that the target character belongs to a segmented character to be segmented based on a second current state of the second state machine and a segmentation processing rule corresponding to the second current state, determining segmentation category information to be segmented; and determining a risk degree of the data file belonging to the website backdoor file with an attack risk based on the segmentation category information. The application can reduce the delay of a firewall device in detecting a risk file.

Description

Technical Field

[0001] This application relates to the field of computer security technology, and in particular to a method and apparatus for determining file risks. Background Technology

[0002] A webshell (website backdoor), also known as a Trojan horse, is a script that can run on a web server. Hackers gain execution privileges by uploading a webshell file to a web server, enabling them to attack the web server, such as stealing user data or modifying web pages.

[0003] To defend against webshell attacks on web servers, firewall devices can use detection programs to inspect the content of data files transmitted to the server. For example, based on the script characteristics of different language types corresponding to webshell files, combined with syntactic semantics, risk detection can be performed on the data files to identify those posing an attack risk. However, when data files are typically transmitted to the server in segments as streams, the detection program in the firewall device needs to obtain and cache the complete data file before it can perform file risk detection, which leads to a delay in risk file detection. Summary of the Invention

[0004] This application provides a method and apparatus for determining file risks, which can reduce the delay in firewall devices detecting risky files.

[0005] On the one hand, this application provides a method for determining document risks, including:

[0006] Obtain segmented messages from a data file, wherein the data file is transmitted to the server in the form of a data stream, and the segmented messages include at least one character.

[0007] Based on the order of characters in the segmented message, determine the target character to be analyzed in the segmented message at the current moment and input it into the first state machine;

[0008] If, based on the first current state of the first state machine and the character recognition rules corresponding to the first current state, it is determined that the target character belongs to a valid code character in a website backdoor file, the target character is input into the second state machine.

[0009] If, based on the current state of the second state machine and the word segmentation rules corresponding to the second current state, it is determined that the target character belongs to the word segmentation character to be segmented, the word segmentation category information to be segmented at the current time is determined;

[0010] Based on the word segmentation category information, the risk level of the data file belonging to a website backdoor file that poses an attack risk is determined.

[0011] In one possible implementation, after obtaining the segmented message from the data file, the method further includes:

[0012] Detect whether the segmented message contains any risky characters that indicate the data file belongs to a website backdoor file;

[0013] After detecting risky characters in the segmented message, the segmented message and other segmented messages obtained after the segmented message are identified as segmented messages to be analyzed.

[0014] The step of determining the target character to be analyzed in the segmented message at the current moment according to the order of characters in the segmented message and inputting it into the first state machine includes:

[0015] For the segmented message to be analyzed, the target character to be analyzed in the segmented message at the current time is determined according to the order of the characters in the segmented message and input into the first state machine.

[0016] In another possible implementation, the step of determining that the target character belongs to a valid code character in a website backdoor file based on the current state of the first state machine and the character recognition rule corresponding to the first current state, and then inputting the target character into the second state machine, includes:

[0017] If the first state machine is currently in the first set state, and the target character does not belong to the end marker character in the script language corresponding to the website backdoor file, the target character is determined to be a valid code character in the script language and input into the second state machine. The first set state indicates that the first state machine determines that the character to be input into the first state machine belongs to the code character in the script language based on the characters before the target character.

[0018] If the first state machine is currently in the second set state, and the target character is a trigger character corresponding to the second set state for triggering entry into the first set state, the target character is determined as a valid code character in the scripting language and input into the second state machine. The second set state is a state in the first state machine that can be converted to the first set state.

[0019] Another possible implementation includes:

[0020] If the first state machine is currently in the second set state, and the target character belongs to the trigger character corresponding to the second set state for triggering entry into the first set state, then switch the state of the first state machine to the first set state.

[0021] Another possible implementation includes:

[0022] If, based on the first current state of the first state machine and the character recognition rules corresponding to the first current state, it is determined that the target character does not belong to the valid code character in the website backdoor file and it is determined that the first state machine meets the state switching conditions, then the first target state that the first state machine needs to switch to is determined.

[0023] Switch the first current state of the first state machine to the first target state.

[0024] In another possible implementation, if the target character is determined to belong to the segmentation character to be segmented based on the current state of the second state machine and the segmentation processing rule corresponding to the second current state, the determination of the segmentation category information to be segmented includes:

[0025] If the second state machine is currently in the third set state, and the target character is determined to be a segmentation character to be segmented based on the segmentation processing rules corresponding to the target set state, the segmentation category information corresponding to the third set state is determined. The third set state is the initial state set by the second state machine or a state that can trigger the determination of non-keyword segmentation based on the characters before the target character.

[0026] If the second state machine is currently in the fourth setting state, and the target character is determined to be a character that triggers word segmentation based on the word segmentation processing rule corresponding to the target setting state, the characters received by the second state machine after the target character are cached, keyword matching is performed based on the cached characters, and word segmentation category information is determined based on the keyword matching result. The fourth setting state is a state that the second state machine determines based on the characters before the target character that can trigger keyword word segmentation.

[0027] In another possible implementation, after determining the word segmentation category information, it also includes:

[0028] Switch the state of the second state machine to the set initial state.

[0029] Another possible implementation includes:

[0030] If, based on the current state of the second state machine and the word segmentation rules corresponding to the current state, it is determined that the target character does not belong to the word segmentation characters to be segmented, the second target state to which the second state machine needs to be switched is determined, and the state of the second state machine is controlled to be in the second target state.

[0031] Furthermore, this application also provides an apparatus for determining document risk, comprising:

[0032] A message acquisition unit is used to acquire segmented messages from a data file, wherein the data file is transmitted to the server in the form of a data stream, and the segmented message includes at least one character.

[0033] The character determination unit is used to determine the target character to be analyzed in the segmented message at the current time according to the order of each character in the segmented message and input it into the first state machine;

[0034] The effective character recognition unit is used to input the target character into the second state machine if, based on the current state of the first state machine and the character recognition rules corresponding to the first current state, the target character is determined to be a valid code character in a website backdoor file.

[0035] The word segmentation processing unit is used to determine the word segmentation category information to be segmented if the target character is determined to be a segmentation character to be segmented based on the current state of the second state machine and the word segmentation processing rule corresponding to the second current state;

[0036] The risk determination unit is used to determine the degree of risk that the data file belongs to a backdoor file of a website with attack risks, based on the word segmentation category information.

[0037] One possible implementation also includes:

[0038] The pre-detection unit is used to detect whether there are risky characters in the segmented messages that indicate that the data file belongs to a website backdoor file after the message acquisition unit obtains the segmented messages from the data file;

[0039] The message determination unit is used to determine the segmented message and other segmented messages obtained after the segmented message as segmented messages to be analyzed after detecting risk characters from the segmented message.

[0040] The character determination unit is specifically used to determine the target character to be analyzed in the segmented message at the current time according to the order of the characters in the segmented message and input it into the first state machine.

[0041] As can be seen from the above, in this embodiment, after each segmented message from the data file is obtained, the target character to be processed can be input into the first state machine according to the order of the characters in the segmented message. The first state machine, combined with its current first current state and the character recognition rules corresponding to the first current state, if it determines that the target character belongs to a valid code character in a website backdoor file with attack risk, it will input the target character into the second state machine. The second state machine, based on its current second current state and the corresponding word segmentation processing rules, can determine the word segmentation category information to be segmented if it determines whether the target character belongs to the word segmentation character to be segmented. This realizes that during the data file transmission process, the word segmentation category information required for Trojan file risk detection can be determined based on the obtained segmented message. Naturally, it is not necessary to perform Trojan file risk detection after obtaining and caching the complete data file, thereby reducing the delay of risk file detection. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0043] Figure 1 This paper illustrates a flowchart of a method for determining document risk according to an embodiment of this application.

[0044] Figure 2 This illustration shows yet another flowchart of the method for determining document risk provided in an embodiment of this application;

[0045] Figure 3 This illustration shows a state transition diagram of the first state machine in an embodiment of this application;

[0046] Figure 4 This illustration shows a state transition diagram of the second state machine in an embodiment of this application;

[0047] Figure 5 A schematic diagram of the structure of an apparatus for determining document risk in an embodiment of this application is shown. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0049] like Figure 1 This document illustrates a flowchart of a method for determining file risk according to an embodiment of this application. The method is applied to a firewall device, which can be independent of a server or the same device as the server. The server mentioned here can be a web server or other types of servers, without limitation. In this application, the firewall device can run a detection program, which performs the relevant operations of the method for determining file risk in this application.

[0050] The method in this embodiment may include:

[0051] S101, obtain segmented messages from the data file.

[0052] In this process, the data file is transmitted to the server in the form of a data stream. Therefore, the sender segments the data file, and each segment is sent to the server as a separate message. Based on this, this application refers to a message originating from a data file and carrying segmented data from the data file as a segmented message.

[0053] Each segmented message includes at least one character.

[0054] Understandably, the character types in segmented messages will differ depending on the type of data file. For example, when the data file is a script file, the characters in the segmented messages will be the code characters used to build the script file.

[0055] S102, determine the target character to be analyzed in the segmented message at the current moment according to the order of characters in the segmented message and input it into the first state machine.

[0056] Understandably, since each character in the segmented message needs to be processed by subsequent steps, this step S102 needs to be executed repeatedly to sequentially determine the characters in the message as the target characters to be analyzed and input them into the first state machine.

[0057] S103, if based on the current state of the first state machine and the character recognition rules corresponding to the current state, it is determined that the target character belongs to the valid code character in the website backdoor file, the target character is input into the second state machine.

[0058] Understandably, a website backdoor (Webshell) file is a script file that may pose an attack risk.

[0059] In this application, for ease of distinction, the state machine used to determine the valid code characters in the script file is called the first state machine, while the state machine used to determine the word segmentation is called the second state machine.

[0060] In this application, a first state machine is associated with multiple states and character recognition rules corresponding to different states. Each character input to the first state machine corresponds to an event. The character recognition rules for each state specify the actions that can be triggered for different input characters within that state.

[0061] The character recognition rule may also include state transition conditions in this state, that is, in this state, the target state that the state machine needs to be in based on different input characters. The target state can be the current state or other states.

[0062] Of course, state transition conditions can be defined separately from character recognition rules, without any restrictions.

[0063] In this application, the states associated with the first state machine and the character recognition rules corresponding to each state can be set based on the scripting language of the Webshell file.

[0064] The first state machine, by combining the currently input character, the current state, and the character recognition rule corresponding to that state, can determine the action to be performed. Simultaneously, the first state machine can, by combining the input character, the current state, and the state transition conditions in the character recognition rule corresponding to that state, or by using separately defined state transition conditions, switch the current state of the first state machine to the corresponding state when it is determined that a state change is required.

[0065] Correspondingly, the current state of the first state machine can represent the category and related information of the characters input into it. If the characters input into the first state machine can indicate that the currently input character or the characters following it belong to valid code characters in the scripting language of the Webshell file, then the currently input character or the characters following it are determined as valid code characters and input into the second state machine.

[0066] In this application, for ease of distinction, the state in which the first state machine is currently when the target character is input is referred to as the first current state. The state in which the second state machine is currently when the subsequent target character is input is referred to as the second current state.

[0067] It is understandable that the scripting language corresponding to a Webshell file may include: a start identifier character, an end identifier character, and valid code characters. The start identifier character and the end identifier character are used to indicate the beginning and end of a scripting language segment, respectively, while the valid code characters are code characters that represent the actual content of the scripting language, in addition to the start and end identifier characters.

[0068] Accordingly, in this application, if it is determined that the target character belongs to the valid code characters in the Webshell file, it means that the target character belongs to the characters that need to be analyzed by syntax and semantics, which is naturally the characters that need to be segmented. Therefore, the target character needs to be input into the second state machine.

[0069] To facilitate understanding of the valid code characters, we will explain several possible scenarios for the scripting languages ​​corresponding to Webshell files. The scripting languages ​​corresponding to Webshell files can include: Jsp, Jspx, Asp, Aspx, and php, etc.

[0070] For the JSP language:

[0071] JSP script elements can be divided into three types: script fragments, declarations, and expressions.

[0072] The format of the script snippet is: <%Java code snippet%>;

[0073] The format for declarations of variables, classes, functions, etc., is: <%! Java code snippet%>;

[0074] The expression format is <%=Java code snippet%>.

[0075] As can be seen, for JSP script fragments, both "<%" are start identifiers, used together to mark the beginning of the script fragment; both "%>" are end identifiers, used to mark the end of the script fragment, and the code characters between "<%" and "%>" are valid code characters. For expressions, all three characters "<%=" are start identifiers, and the end identifier includes "%>", while the characters within the "Java code fragment" are valid code characters. For declarations, all three characters "<%!" are start identifiers, and the end identifier includes "%>", while the characters within the "Java code fragment" are valid code characters.

[0076] In the JSPX language, script elements can also be divided into three types: script fragments, declarations, and expressions.

[0077] The format of the script fragment is as follows:<xxx:scriptlet> Java code snippet< / xxx:scriptlet> ;

[0078] The format for declarations of variables, classes, functions, etc., is as follows: <xxx:declaration> Java code snippet< / xxx:declaration> ;

[0079] The format of the expression is: <xxx:expression> Java code snippet< / xxx:expression> Here, "xxx" represents the namespace, which defaults to JSP but can also be customized.

[0080] In the JSPX script snippet, the use of " <xxx:scriptlet> "Indicates the start of a script segment; therefore, these characters are all start marker characters, and so on."< / xxx:scriptlet> These characters are used to mark the end of a script segment; they are all end-of-segment markers. <xxx:scriptlet> "and"< / xxx:scriptlet> The characters between "" are valid code characters.

[0081] Similarly, the ASP language includes script snippets, represented as: <%...%> or, <script>…< / script> The ASPX language also includes script fragments, represented as <%...%>, and the PHP language also includes script fragments, represented as <?PHP code?>. The process of determining the start identifier, end identifier, and valid code characters in these scripting languages ​​is similar to that described above and will not be repeated here.

[0082] In one possible implementation, the first state machine includes at least a first set state, which indicates that the first state machine determines, based on the characters preceding the target character, that the character to be input to the first state belongs to the code characters in the scripting language corresponding to the Webshell file.

[0083] Based on this, if the first current state of the first state machine is the first set state, then the first state machine can detect a combination of one or more start identifier characters representing the script file corresponding to the Webshell file before the currently input target character. Naturally, it can be determined that the currently input target character must belong to the code characters in the script language corresponding to the Webshell file.

[0084] However, when performing word segmentation, only valid code characters in the script language corresponding to the Webshell file need to be considered, without needing to consider the end marker character indicating the end of a script language segment. Accordingly, if the first state machine is currently in the first set state, and the target character does not belong to the end marker character in the script language corresponding to the website backdoor file, the target character is determined as a valid code character and input into the second state machine.

[0085] Furthermore, the first state machine may also include a second set state, which is a state in the first state machine that can be transformed into the first set state.

[0086] Accordingly, if the first state machine is currently in the second set state, and the target character is the trigger character corresponding to the second set state for triggering entry into the first set state, the target character is determined as a valid code character in the script language corresponding to the Webshell file and input into the second state machine.

[0087] Whether the target character belongs to the trigger character that triggers entry into the first set state can be set in the character recognition rules corresponding to the second set state, in combination with the language characteristics of the script language corresponding to the Webshell file.

[0088] If the target character is a trigger character that triggers entry into the first set state, then the target character is also a valid code character. Therefore, the target character needs to be input into the second state machine as well.

[0089] It is understandable that if the first state machine is currently in the second set state, and the target character is the trigger character corresponding to the second set state used to trigger entry into the first set state, the state of the first state machine needs to be switched from the second set state to the first set state so that the non-terminal identifiers subsequently input into the first state machine can be determined as valid code characters.

[0090] It is understandable that after the target character is input into the first state machine, a state transition of the first state machine may be triggered. Based on this, if, based on the current first state of the first state machine and the character recognition rules corresponding to the current first state, it is determined that the target character does not belong to a valid code character in the website's backdoor file and that the first state machine meets the state transition conditions, the first target state to which the first state machine needs to be switched is determined. The first current state of the first state machine is then switched to this first target state.

[0091] Similarly, if the first state machine is currently in the first set state and the target character is the end identifier in the script language corresponding to the Webshell file, this application will also determine the desired state that the first state machine needs to switch to and switch the first set state to the corresponding desired state.

[0092] It is understandable that, in determining whether a character belongs to a valid code character in a Webshell file based on the first state machine, it is only necessary to combine the current state of the first state machine with the currently input target character to determine whether the target character belongs to a valid code character in the Webshell file. This allows caching other characters before the target character and also enables the identification of valid code characters in the Webshell file.

[0093] S104. If the target character is determined to be a segmentation character to be segmented based on the current state of the second state machine and the segmentation processing rule corresponding to the current state, determine the segmentation category information to be segmented.

[0094] In this context, the target character being a segmentation character indicates that the target character is a segmentation point. For example, the target character is a segmentation word, the target character and at least one character before the target character are combined to form a segmentation word, or a new segmentation word appears after the target character.

[0095] In this application, word segmentation refers to splitting a code segment consisting of valid code characters in the script of a Webshell file into multiple words and determining the category information corresponding to each word.

[0096] Correspondingly, word segmentation category information is used to represent the category to which a word belongs. For example, word segmentation category information can be a category identifier or other information representing the category to which the category belongs, without any restrictions.

[0097] In webshell scripts, there are various categories of word segmentation, such as keyword segmentation, identifier segmentation, operator segmentation, and string segmentation. Of course, the classification of word segmentation categories will differ depending on the scripting language used in the webshell file; there are no strict limitations on this.

[0098] Similar to the first state machine, this second state machine is associated with multiple states and corresponding word segmentation rules for each state. The target character input to the second state machine is equivalent to an event, and the word segmentation rules for each state specify the actions that can be triggered for different target characters input in that state. For example, these actions may include whether to determine the target character as a word segmentation point or as a word segmentation starting point, and, if word segmentation is required, the specific implementation of determining the word segmentation category information.

[0099] It is understandable that the word segmentation processing rule may also include the state transition conditions from the current state to other states in the second state machine. Based on the state transition conditions, it can be determined whether the input of the target character in the current state requires switching the state of the second state machine and the target state that the second state machine needs to switch to.

[0100] Of course, the state switching conditions of the second state machine in different states can also be configured independently of the word segmentation processing rules, without any restrictions.

[0101] In this application, the state to which the second state machine needs to switch each time a different character is input, as well as whether the different characters input in each state belong to the segmented words to be segmented and the segmentation category information corresponding to the segmented characters in that state, can all be determined by combining the segmentation specification corresponding to the script language of the Webshell file, without any specific restrictions.

[0102] The different states of the second state machine and the different input characters may affect whether the conditions for word segmentation are met and the word category information of the segmented words.

[0103] Understandably, if the target character is determined not to be a segmented character based on the current state of the second state machine and the corresponding segmentation rules, the second state machine needs to switch to, and the second state machine is controlled to remain in the second target state. For example, if the second target state is the same as the second current state, then the second current state needs to be maintained; if the second target state is different from the second current state, then the state of the second state machine needs to be switched from the second current state to the second target state.

[0104] In step S104, the classification categories of each word segment that can be extracted from the code segment corresponding to the Webshell file are determined. Since the second state machine, after obtaining each character, combines its current state with the corresponding word segmentation rules, it can determine whether word segmentation is needed for the target character and the required word segmentation category information. Simultaneously, the second state machine will adjust its state as needed, so that its state can represent the currently received characters that have not yet undergone word segmentation. Based on this, regardless of the target character's current location in the data file, the second state machine can perform the corresponding word segmentation action based on its current state and the corresponding word segmentation recognition rules, thus eliminating the need to cache the characters of the received segmented message and reducing the amount of data that the detection program needs to cache.

[0105] S105, Based on the word segmentation category information, determine the risk level of the data file belonging to a website backdoor file that poses an attack risk.

[0106] Understandably, if the target characters are valid code characters within a Webshell file, it indicates that the data file is indeed a Webshell file. However, not all Webshell files will attack the server. Therefore, when detecting the risk of a Webshell file, the degree of risk is generally determined. Based on whether the data file belongs to a Webshell file with attack risk, it is determined whether the data file is a Trojan file, and then appropriate interception and other processing measures are taken.

[0107] In this application, the risk level of a data file belonging to a Webshell file with attack risks is determined based on the word segmentation category information sequentially identified from the segmented messages of the data file. This is a general method for detecting the risk level of Webshell files, and this application does not impose any limitations on it. For example, syntactic and semantic analysis can be performed based on the word segmentation category information to determine the attack risk score of the Webshell file.

[0108] In one possible implementation, this application can utilize the Bison tool for syntax analysis. Bison is a tool for generating parsers that can generate C or C++ code based on a specified grammar description file. This generated code is used to parse the input text and determine the corresponding grammar. The grammar description file of the Bison tool uses a Backus paradigm-like grammar description.

[0109] Accordingly, in this application, the Bison tool may have a pre-configured syntax for the scripting language corresponding to the Webshell file. The Bison tool can then convert the configured syntax into C or C++ code. Consequently, by calling the Bison tool, it can determine the syntax corresponding to the word segmentation category information by converting the C or C++ code.

[0110] For example, the Bison tool can call its own syntax transformation function interface yypush_parse() and combine it with shift reduction to perform syntax detection on the input word segmentation category information and determine the syntax information.

[0111] It is understandable that when using tools like Bison or other methods to perform syntactic analysis on word segmentation category information, it is necessary to combine the word segmentation category information that is input sequentially to determine what can be reduced to a sentence before performing syntactic analysis. Therefore, this application may combine one or more recently input word segmentation category information for syntactic word segmentation. Of course, this is a conventional method of syntactic analysis, and this application will not elaborate on it further.

[0112] Based on the semantic analysis results and the analyzed grammatical information, this application can combine a pre-defined scoring model to determine the probability score of whether a Webshell file exists, corresponding to certain malicious behaviors. Malicious behaviors can include data theft and webpage tampering.

[0113] In one alternative approach, blacklist recognition rules can also be associated with at least some states of the second state machine. After the target character is identified as a word segmentation character, if it is determined that the word segmentation category belongs to the word segmentation category within the blacklist, the category will also be marked so as to add a score to the statement corresponding to the blacklist during the semantic analysis process. The higher the score, the higher the danger level.

[0114] As can be seen from the above, in this embodiment, after each segmented message from the data file is obtained, the target character to be processed can be input into the first state machine according to the order of the characters in the segmented message. The first state machine, combined with its current first current state and the character recognition rules corresponding to the first current state, if it determines that the target character belongs to a valid code character in a website backdoor file with attack risk, it will input the target character into the second state machine. The second state machine, based on its current second current state and the corresponding word segmentation processing rules, can determine the word segmentation category information to be segmented if it determines whether the target character belongs to the word segmentation character to be segmented. This realizes that during the data file transmission process, the word segmentation category information required for Trojan file risk detection can be determined based on the obtained segmented message. Naturally, it is not necessary to perform Trojan file risk detection after obtaining and caching the complete data file, thereby reducing the delay of risk file detection.

[0115] In addition, the inventors of this application have also discovered that: currently, risk file detection needs to be performed after obtaining the entire data file, and the entire data file needs to be cached in the memory corresponding to the detection program in order to achieve risk file detection.

[0116] In this application, after obtaining the segmented messages of the data file, the characters in the segmented messages can be sequentially input into the first state machine. Since the state of the first state machine reflects the characters already input, the first state machine, combined with its current state and the corresponding character recognition rules, can determine whether the target character belongs to a valid code character in the script language of the Webshell file. Therefore, the first state machine does not need to cache other characters before the target character, and naturally, it does not need to cache all the characters in the received segmented messages. Similarly, the second state machine, combined with its current state and the corresponding word segmentation rules, can determine whether the target character is a word segmentation character, and determine the word segmentation category information when the target character is a word segmentation character. It also does not need to cache all the characters in the received segmented messages, thus reducing the amount of data that the detection program needs to cache. This reduces the possibility of insufficient cache space due to the large data size of the data file, which could affect the detection of risky files.

[0117] It is understandable that the data file transmitted to the server can be a regular data file other than a Webshell file. If characters that are not from a Webshell file are also processed through the first state machine, it will naturally fail to recognize the valid code characters belonging to a Webshell file, and will also affect the data processing efficiency.

[0118] Therefore, to improve the detection performance of risky files, this application, before sequentially identifying the characters in the segmented messages as target characters and inputting them into the first state machine, can also detect whether there are risky characters in the segmented messages from the data file that indicate the data file belongs to a website backdoor file. Only after detecting risky characters from the segmented messages will the segmented messages and other segmented messages obtained after them be identified as segmented messages to be analyzed. Only the characters in the segmented messages to be analyzed need to be input into the first state machine for corresponding processing.

[0119] To facilitate understanding, a specific implementation will be used as an example below.

[0120] like Figure 2 As shown, it illustrates another flowchart of a method for determining document risk according to an embodiment of this application. The method of this embodiment may include:

[0121] S201, obtain segmented messages from the data file.

[0122] The data file is transmitted to the server in the form of a data stream.

[0123] The segmented message includes at least one character.

[0124] This step can be referred to in the relevant description of the previous embodiments, and will not be repeated here.

[0125] S202, Detect whether there are risky characters in the segmented message indicating that the data file belongs to a website backdoor file.

[0126] The risk character is used to indicate that the data file was generated by the scripting language corresponding to the Webshell file. For example, the risk character can be the start identifier character in the scripting language corresponding to the Webshell file.

[0127] For example, as we can see from the script elements that may be involved in the different script language formats corresponding to Webshell files, each script language format has its own specific combination of start identifier characters to represent a script element. Therefore, the first start identifier character of a script element can be identified as a risk character.

[0128] For example, if a JSP script fragment needs to start with "<%", then "<" can be set as a risk character. Correspondingly, if "<" does not appear in the first few segments of the data file, it means that the data packet does not belong to the Webshell file, and these segments do not need to be processed further.

[0129] S203, after detecting a risky character in a segmented message, the segmented message and other segmented messages obtained after it are identified as segments to be analyzed.

[0130] As shown in the previous example, only when a risky character appears in a segment of the data file can it be concluded that the data file is a Webshell file, and only then can it be concluded that the script code in the Webshell file will be contained starting from that segment. Therefore, it is only necessary to process the segment that detects the risky character and other segmented messages in the data file that follow that segment.

[0131] S204. For the segmented message to be analyzed, determine the target character to be analyzed in the segmented message at the current time according to the order of the characters in the segmented message and input it into the first state machine.

[0132] In this embodiment, only the segmented packets identified in step S203 that belong to the segment to be analyzed will be processed in step S204 and subsequent related processing. For details of the processing, please refer to the relevant descriptions in the previous embodiments, which will not be repeated here.

[0133] S205, if the first state machine is currently in the first set state, and the target character does not belong to the end identifier character in the script language corresponding to the website backdoor file, the target character is determined as a valid code character in the script language and input into the second state machine.

[0134] The first set state indicates that the first state machine determines the code character to which the character to be input in the first state belongs based on the characters preceding the target character.

[0135] S206, if the first state machine is currently in the second set state, and the target character is the trigger character corresponding to the second set state for triggering entry into the first set state, the target character is determined as a valid code character in the script language corresponding to the website backdoor file and input into the second state machine, and the state of the first state machine is switched to the first set state.

[0136] The second set state is a state in the first state machine that can be converted to the first set state.

[0137] Steps S205 and S206 above can be found in the relevant descriptions of the previous embodiments, and will not be repeated here.

[0138] S207, if based on the current state of the first state machine and the character recognition rules corresponding to the current state, it is determined that the target character does not belong to the valid code character in the website backdoor file and the first state machine meets the state switching conditions, the first target state to which the first state machine needs to be switched is determined, and the first current state of the first state machine is switched to the first target state.

[0139] It is understandable that the first target state can be the initial state of the first state machine, the second set state, or any state between the initial state and the second set state.

[0140] For ease of understanding, steps S205 to S207 of this application will be explained below using JSP as an example of the scripting language of the Webshell file. This will be combined with the script fragments, expressions, and declarations in the JSP script elements mentioned earlier, and further explained using... Figure 3 Explanation:

[0141] In such Figure 3 The diagram shows a schematic of the different state transitions in the first state machine.

[0142] Suppose that the initial state of the first state machine is represented as state 00.

[0143] Depend on Figure 3It can be seen that when the first state machine is in the initial state 00, if the input character (i.e. the target character) is "<", the first state machine will be triggered to enter state 01; if the input is other characters, the initial state of the first state will remain unchanged.

[0144] When the first state machine is currently in state 01, if the input character is "%", it enters state 02; if the input character is not "%", it means that the input is not a JSP script, and it returns to the initial state 00. Of course, in practical applications, in state 01, if the input is a character or an underscore, it means that the current input should be JSP, and the corresponding state logic processing for JSP can be initiated. This embodiment uses JSP as an example for analysis, and this situation will not be elaborated further.

[0145] When the first state machine is in state 02, if the input character is "=", the first state machine switches to state 03; if the input character is "!", the first state machine switches to state 04; if the input is "@", it belongs to other instructions and is considered to enter a special state, which is not relevant to this discussion and will not be discussed further; if other characters are input, the character will be input to the second state machine, and the first state machine will switch to state 05.

[0146] In the case where “<%” has been received in the first state machine, i.e., when entering state 02, it can be determined that the data file belongs to a script fragment, expression, or format in the JSP language. If the characters received by the first state machine do not belong to expressions or declarations, it means that the input characters belong to valid code characters in the script fragment.

[0147] Meanwhile, if the current state of the first state machine is state 03, it means that the characters input to the first state machine include "<%=", which is the start marker of an expression in the JSP language. Therefore, if the first state machine is in state 03, it indicates that the characters to be input to the first state machine later are valid code characters within a JAVA expression.

[0148] Based on this, if the first state machine is in state 03, then if any character is input, this application will determine the character as a valid code character and send it to the second state machine, while switching the first state machine to state 05.

[0149] Similarly, if the current state of the first state machine is state 04, it means that the first state machine has confirmed the detection of the start identifiers that identify the JAVA declaration section. Accordingly, any characters input into the first state machine at this time will be determined as valid code characters and sent to the second state machine. At the same time, the first state machine will also switch to state 05.

[0150] When the current state of the first state machine is state 05, it can be determined that the character to be input to the first state may be a character in a script fragment, expression, or declaration, but it may be an end marker character. Therefore, if the character input to the first state machine is not "%" (the first end marker that appears at the end of the code of a script fragment, expression, or declaration), then it can be determined that the input character is a valid code character and sent to the second state machine, while keeping the current state of the first state machine unchanged at state 05.

[0151] Of course, if the input character is “%” when the first state machine is in state 05, the first state machine can be switched to state 06.

[0152] When the first state machine is in state 06, if the input character is ">", it indicates the end of a script code segment corresponding to a script fragment, declaration, or expression. In this case, the character will not be passed to the second state machine, and the second state machine will enter state 07. Alternatively, state 07 can be ignored, in which case the first state machine will switch back to its initial state 00. If the input character is not ">", it means the character "%" represents an internal algorithm within the code. In this case, the machine can return to state 05. However, the character "%" and the currently input character still need to be transmitted to the second state machine.

[0153] When the first state machine is in state 07, if the input character is "<", the first state machine enters state 01; if the input is any other character, the first state machine enters the initial state 00.

[0154] It can be seen that when the first state machine enters state 06, it can only cache the character "%" that triggered the first state machine to enter state 06, so that when returning to state 05, the character "%" can also be transmitted to the second state machine.

[0155] As shown in the example above, state 05 is the first set state. In state 05, any non-ending identifier character input to the first state machine will be input to the second state machine. States 02, 03, and 04 all belong to the second set state. Specifically, the character that triggers entry into the first set state (state 05) in state 02 can be any character other than "=" and "!", while the characters that trigger entry into the first set state in states 03 and 04 can be any character.

[0156] Meanwhile, in the example above, the first state machine involves maintaining or switching states in different states, which will not be elaborated further.

[0157] It should be noted that this embodiment is based on the case of steps S205 to S207. Other implementations of the first state machine determining the target character as a valid code character are also applicable to this embodiment, and will not be described in detail here.

[0158] S208, if the target character is determined to be a segmentation character to be segmented based on the current state of the second state machine and the segmentation processing rule corresponding to the current state, the segmentation category information to be segmented is determined.

[0159] The steps are the same as those described in the previous embodiments, and will not be repeated here.

[0160] It is understandable that after each word segmentation is completed, the next word segmentation needs to be determined again. Based on this, after determining the word segmentation category information to be segmented, the state of the second state machine can be switched to the initial state of the second state machine.

[0161] Understandably, for keyword segmentation in script files, it is necessary to match one or more characters with the configured keywords. Based on this, the second state machine of this application also needs to appropriately cache a small number of characters after the target character in some cases.

[0162] Specifically, if the second state machine is currently in the third set state, and the target character is determined to be a segmentation character to be segmented based on the segmentation processing rules corresponding to the target set state, the segmentation category information corresponding to the third set state is determined. This third set state is either the initial state set by the second state machine, or a state determined by the second state machine based on the characters preceding the target character that can trigger the determination of non-keyword segmentation.

[0163] Accordingly, if the second state machine is currently in the fourth setting state, and the segmentation character that triggers segmentation is determined based on the segmentation rules corresponding to the target setting state, the characters received by the second state machine after the target character are cached. Keyword matching is performed based on the cached characters, and the segmentation category information is determined based on the keyword matching results. Here, the fourth setting state is the state determined by the second state machine based on the characters preceding the target character, which can trigger keyword segmentation.

[0164] Specifically, keyword matching is performed based on cached characters. If the obtained keyword matching result indicates that keyword segmentation is determined, then segmentation category information indicating keyword segmentation is generated. If the keyword matching result indicates that the determined keyword segmentation is not keyword segmentation, but identifier segmentation is determined, then segmentation category information indicating identifier segmentation is generated.

[0165] To facilitate understanding, a simple explanation will be provided with examples.

[0166] Because the scripting languages ​​used in webshell files contain numerous lexical terms, the states involved in triggering analysis in the second state machine are also quite complex. For ease of description, we will take some word segmentation types and their corresponding states as examples, combined with... Figure 4 The state transition diagram of the second state machine is shown for illustration.

[0167] Assuming the second state machine includes the following states corresponding to word segmentation, the following description is based on the word segmentation type (the state of the second state machine corresponding to the word segmentation type):

[0168] Identifiers and keywords (state 001)

[0169] Characters and strings, to be continued Figure 4 This explanation uses a string as an example (state 002);

[0170] Assignment operators, Figure 4 Taking the equal sign, division, bitwise AND compound assignment operators in the assignment operator as examples (corresponding to states 003, 004 and 005 respectively);

[0171] Arithmetic operators Figure 4 Taking division as an example (state 006);

[0172] Bitwise operators Figure 4 Taking bitwise AND as an example (state 007);

[0173] Logical operators Figure 4 Take logical AND and logical Equal as examples (corresponding to state 008 and state 009 respectively);

[0174] Conditional operator, Figure 4 Taking logical greater than and greater than or equal to as examples (state 010 and state 011);

[0175] Shift operators Figure 4 Taking rightward movement as an example (state 012);

[0176] Comments, including single-line injection and multi-line comments (corresponding to states 013, 014 and 015 respectively);

[0177] Of course, the script code also involves some independent word segmentation characters such as "(", ")", "[", "]", "{", "}", ";", ",", "@", "~", "?", etc.

[0178] There are some Figure 4 Word segmentation characters that may not be covered in the text will not be discussed further here.

[0179] Depend on Figure 4 It can be seen that the initial state of the second state machine is state 000;

[0180] For the second state machine, when the current state is the initial state (state 000), if the input character (target character) is "(", ")", "[", "]", "{", "}", ";", ",", "@", "~", "?", etc., it is determined that word segmentation is required, and the corresponding word segmentation category information is generated and sent to the syntax analysis stage involved in the subsequent step S209. The state of the second state machine remains unchanged. If the input is a letter or an underscore, it enters state 001, and the buffer of the second state machine is activated to cache the current character. If the input character is a double quote, it enters state 002. If the input is a forward slash, it enters state 006. If the input is "&", it enters state 007. If the input is a greater than sign, it enters state 010. If the input is an equal sign, it enters state 003. The cases of inputting other characters will not be described in detail.

[0181] When the second state machine is currently in state 001, if the input character is a letter, number, or underscore, the state remains unchanged and the current character is cached. If the input character is another type (such as a space or parentheses), keyword matching is performed on the cached character. If a keyword is matched, the segmentation category information corresponding to the keyword segmentation is generated and input into the subsequent syntax analysis stage, and the state of the second state machine is restored to the initial state 000. If it is not a keyword, the identifier segmentation is generated and sent to the syntax analysis, and the state is restored to the initial state 000.

[0182] When the second state machine is currently in state 002, if the input character is a double quote, the end of the string is confirmed, the segmentation category information corresponding to the string segmentation is generated, the syntax analysis is performed, and the state of the second state machine is restored to the initial state 000; if the input character is an escape character, it enters state 016.

[0183] When the current state of the second state machine is state 016, this step mainly processes strings containing escaped quotes. After processing the escaped quotes, the state is restored to state 002.

[0184] When the second state machine is currently in state 006, if the input character is an equal sign, the second state machine enters state 004; if the input character is a forward slash, it enters state 013; if the input character is an asterisk, it enters state 014; if the input is any other character, it is determined that the division sign segmentation is satisfied, the segmentation category information corresponding to the division sign segmentation is generated, and it is sent to the syntax analysis. The state of the second state machine is restored to the initial state 000.

[0185] When the second state machine is currently in state 004, the word segmentation symbols corresponding to the compound assignment operator are generated and sent to the syntax analysis, and the state of the second state machine is restored to the initial state 000.

[0186] When the second state machine is currently in state 013, if the input is \r or \n, it is considered that the line comment has ended and does not need to be sent to the syntax analysis. The state of the second state machine is restored to the initial state 000. If the input is other, the state of the second state machine remains in state 013.

[0187] When the second state machine is currently in state 014, if the input is an asterisk, the second state machine switches to state 015; if the input is any other character, the state of the second state machine remains unchanged.

[0188] When the second state machine is currently in state 015, if the input is a forward slash, it is considered that the multi-line comment has ended and does not need to be sent to the syntax analysis. The state of the second state machine is restored to the initial state 000. If the input is other characters, the state of the second state machine is restored to state 014.

[0189] When the second state machine is currently in state 007, if the input is an AND sign, it enters state 008. If the input character is an equal sign, it enters state 005; if the input is any other character, it generates word segmentation category information corresponding to the segmentation, sends it to the syntax analysis stage, and the state of the second state machine returns to the initial state 000.

[0190] When the second state machine is currently in state 008, the generation logic and the word segmentation category information corresponding to the word segmentation are generated and sent to the syntax analysis. The state of the second state machine is restored to the initial state 000.

[0191] When the second state machine is currently in state 005, the word segmentation category information corresponding to the compound assignment operator is generated and sent to the syntax analysis stage, and the state is restored to the initial state 000.

[0192] When the second state machine is currently in state 010, if the input character is a greater than sign, it enters state 012; if the input character is an equal sign, the second state machine enters state 011; if the input is other characters, the word segmentation category information corresponding to the greater than sign is generated and sent to the syntax analysis stage, and the state of the second state machine is restored to the initial state 000.

[0193] When the second state machine is currently in state 012, the segmentation category information corresponding to the right-shifted segmentation is generated and sent to the syntax analysis stage, and the state is restored to the initial state 000.

[0194] When the second state machine is currently in state 011, it generates word segmentation category information corresponding to words greater than or equal to the word segmentation, sends it to the syntax analysis stage, and the state of the second state machine is restored to the initial state 000.

[0195] When the second state machine is currently in state 003, if the input character is an equal sign, the state of the second state machine switches to state 009; if the input character is other, the word segmentation category information corresponding to the assignment word segmentation is generated and sent to the syntax analysis stage, and the state of the second state machine is restored to the initial state 000.

[0196] When the second state machine is currently in state 009, the generation logic is equal to the word segmentation category information corresponding to the word segmentation, which is then sent to the syntax analysis stage, and the state is restored to the initial state 000.

[0197] certainly, Figure 4 This is merely a simple explanation of some states that the second state machine may involve, the transition relationships between states, and the segmentation category information that may be determined. In practical applications, the segmentation strategy can be set according to the scripting language used by the Webshell file, without any restrictions.

[0198] S209, Based on the word segmentation category information, determine the degree of risk that the data file belongs to a backdoor file of a website with attack risks.

[0199] This step of determining the level of risk may involve two stages: syntactic analysis and semantic analysis. For details, please refer to the previous introductions, which will not be repeated here.

[0200] Experiments have verified that, based on the scheme of this application, for a 135,712-byte Trojan file, 4,096 bytes are read each time and passed through the first state machine, the second state machine, and risk determination in sequence, which can detect the attack behavior. Therefore, it is not necessary to wait for the entire data of the Trojan file to be received before detection can be performed. Moreover, at most 4,096 bytes are needed each time during detection, which reduces the number of bytes that need to be cached and lowers the cache space requirements of the detection program.

[0201] In accordance with the method for determining document risk in this application, this application also provides an apparatus for determining document risk.

[0202] like Figure 5 The diagram illustrates a structural composition of an apparatus for determining document risk according to an embodiment of this application. The apparatus in this embodiment may include:

[0203] The message acquisition unit 501 is used to acquire segmented messages from a data file, wherein the data file is transmitted to the server in the form of a data stream, and the segmented messages include at least one character.

[0204] The character determination unit 502 is used to determine the target character to be analyzed in the segmented message at the current time according to the order of each character in the segmented message and input it into the first state machine;

[0205] The valid character recognition unit 503 is used to input the target character into the second state machine if, based on the current state of the first state machine and the character recognition rule corresponding to the first current state, the target character is determined to be a valid code character in a website backdoor file.

[0206] The word segmentation processing unit 504 is used to determine the word segmentation category information to be segmented if the target character is determined to be a segmentation character to be segmented based on the current state of the second state machine and the word segmentation processing rule corresponding to the second current state;

[0207] The risk determination unit 505 is used to determine the degree of risk that the data file belongs to a website backdoor file with attack risk based on the word segmentation category information.

[0208] In one possible implementation, the device further includes:

[0209] The pre-detection unit is used to detect whether there are risky characters in the segmented messages that indicate that the data file belongs to a website backdoor file after the message acquisition unit obtains the segmented messages from the data file;

[0210] The message determination unit is used to determine the segmented message and other segmented messages obtained after the segmented message as segmented messages to be analyzed after detecting risk characters from the segmented message.

[0211] The character determination unit is specifically used to determine the target character to be analyzed in the segmented message at the current time according to the order of the characters in the segmented message and input it into the first state machine.

[0212] In yet another possible implementation, the effective character recognition unit includes:

[0213] The first character recognition unit is configured to determine the target character as a valid code character in the script language and input it into the second state machine if the first state machine is currently in a first set state and the target character does not belong to the end identifier character in the script language corresponding to the website backdoor file. The first set state indicates that the first state machine determines that the character to be input into the first state machine belongs to the code character in the script language based on the characters preceding the target character.

[0214] The second character recognition unit is used to determine the target character as a valid code character in the scripting language and input it into the second state machine if the first state machine is currently in the second set state and the target character belongs to the trigger character corresponding to the second set state for triggering entry into the first set state. The second set state is a state in the first state machine that can be converted to the first set state.

[0215] Furthermore, the device also includes:

[0216] A state switching unit is configured to switch the state of the first state machine to the first set state if the first state machine is currently in the second set state and the target character belongs to the trigger character corresponding to the second set state for triggering entry into the first set state.

[0217] In yet another possible implementation, the device further includes:

[0218] The state determination unit is used to determine the first target state that the first state machine needs to switch to if, based on the current first current state of the first state machine and the character recognition rule corresponding to the first current state, it is determined that the target character does not belong to the valid code character in the website backdoor file and the first state machine meets the state switching conditions.

[0219] The first state switching unit is used to switch the first current state of the first state machine to the first target state.

[0220] In another possible implementation, the word segmentation unit includes:

[0221] The first word segmentation processing unit is configured to determine the word segmentation category information corresponding to the third setting state if the second state machine is currently in the third setting state and the target character is determined to be a word character to be segmented based on the word segmentation processing rules corresponding to the target setting state. The third setting state is either the initial state set by the second state machine or a state that can trigger the determination of non-keyword word segmentation based on the characters before the target character determined by the second state machine.

[0222] The second word segmentation processing unit is configured to, if the second state machine is currently in the fourth set state and the word segmentation processing rule corresponding to the target set state determines that the target character belongs to the word segmentation character that triggers word segmentation, cache the characters received by the second state machine after the target character, perform keyword matching based on the cached characters, and determine the word segmentation category information based on the keyword matching result. The fourth set state is a state that the second state machine determines based on the characters before the target character that can trigger keyword word segmentation.

[0223] In yet another possible implementation, the device further includes:

[0224] The initial state recovery unit is used to switch the state of the second state machine to the set initial state after the word segmentation processing unit determines the word segmentation category information.

[0225] In yet another possible implementation, the device further includes:

[0226] The second state switching unit is used to determine the second target state that the second state machine needs to switch to if the target character is determined not to be segmented based on the current second current state of the second state machine and the segmentation processing rule corresponding to the second current state, and to control the state of the second state machine to be in the second target state.

[0227] It is understood that in this application, the terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar parts and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that illustrated herein.

[0228] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Furthermore, the features described in the various embodiments of this specification can be substituted or combined with each other, enabling those skilled in the art to implement or use this application. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0229] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0230] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0231] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining document risk, characterized in that, include: Obtain segmented messages from a data file, wherein the data file is transmitted to the server in the form of a data stream, and the segmented messages include at least one character. Based on the order of characters in the segmented message, determine the target character to be analyzed in the segmented message at the current moment and input it into the first state machine; If, based on the first current state of the first state machine and the character recognition rules corresponding to the first current state, it is determined that the target character belongs to a valid code character in a website backdoor file, the target character is input into the second state machine. If, based on the current state of the second state machine and the word segmentation rules corresponding to the second current state, it is determined that the target character belongs to the word segmentation character to be segmented, the word segmentation category information to be segmented at the current time is determined; Based on the word segmentation category information, the degree of risk of the data file belonging to a website backdoor file with attack risk is determined; Wherein, if the target character is determined to belong to the segmentation character to be segmented based on the current state of the second state machine and the segmentation processing rule corresponding to the second current state, the determination of the segmentation category information to be segmented includes: If the second state machine is currently in the third set state, and the target character is determined to be a segmentation character to be segmented based on the segmentation processing rules corresponding to the target set state, the segmentation category information corresponding to the third set state is determined. The third set state is the initial state set by the second state machine or a state that can trigger the determination of non-keyword segmentation based on the characters before the target character determined by the second state machine. If the second state machine is currently in the fourth setting state, and the target character is determined to be a character that triggers word segmentation based on the word segmentation processing rule corresponding to the target setting state, the characters received by the second state machine after the target character are cached, keyword matching is performed based on the cached characters, and word segmentation category information is determined based on the keyword matching result. The fourth setting state is a state that the second state machine determines based on the characters before the target character that can trigger keyword word segmentation.

2. The method for determining document risk according to claim 1, characterized in that, After obtaining the segmented message from the data file, the process further includes: Detect whether the segmented message contains any risky characters that indicate the data file belongs to a website backdoor file; After detecting risky characters in the segmented message, the segmented message and other segmented messages obtained after the segmented message are identified as segmented messages to be analyzed. The step of determining the target character to be analyzed in the segmented message at the current moment according to the order of characters in the segmented message and inputting it into the first state machine includes: For the segmented message to be analyzed, the target character to be analyzed in the segmented message at the current time is determined according to the order of the characters in the segmented message and input into the first state machine.

3. The method for determining document risk according to claim 1, characterized in that, If, based on the current state of the first state machine and the character recognition rules corresponding to the first current state, the target character is determined to belong to a valid code character in a website backdoor file, the target character is then input into the second state machine, including: If the first state machine is currently in the first set state, and the target character does not belong to the end marker character in the script language corresponding to the website backdoor file, the target character is determined to be a valid code character in the script language and input into the second state machine. The first set state indicates that the first state machine determines that the character to be input into the first state machine belongs to the code character in the script language based on the characters before the target character. If the first state machine is currently in the second set state, and the target character is a trigger character corresponding to the second set state for triggering entry into the first set state, the target character is determined as a valid code character in the scripting language and input into the second state machine. The second set state is a state in the first state machine that can be converted to the first set state.

4. The method for determining document risk according to claim 3, characterized in that, Also includes: If the first state machine is currently in the second set state, and the target character belongs to the trigger character corresponding to the second set state for triggering entry into the first set state, then switch the state of the first state machine to the first set state.

5. The method for determining document risk according to claim 1, characterized in that, Also includes: If, based on the first current state of the first state machine and the character recognition rules corresponding to the first current state, it is determined that the target character does not belong to the valid code character in the website backdoor file and it is determined that the first state machine meets the state switching conditions, then the first target state that the first state machine needs to switch to is determined. Switch the first current state of the first state machine to the first target state.

6. The method for determining document risk according to claim 1, characterized in that, After determining the word segmentation category information, the following is also included: Switch the state of the second state machine to the set initial state.

7. The method for determining document risk according to claim 1, characterized in that, Also includes: If, based on the current state of the second state machine and the word segmentation rules corresponding to the current state, it is determined that the target character does not belong to the word segmentation characters to be segmented, the second target state to which the second state machine needs to be switched is determined, and the state of the second state machine is controlled to be in the second target state.

8. An apparatus for determining document risk, characterized in that, include: A message acquisition unit is used to acquire segmented messages from a data file, wherein the data file is transmitted to the server in the form of a data stream, and the segmented message includes at least one character. The character determination unit is used to determine the target character to be analyzed in the segmented message at the current time according to the order of each character in the segmented message and input it into the first state machine; The effective character recognition unit is used to input the target character into the second state machine if, based on the current state of the first state machine and the character recognition rules corresponding to the first current state, the target character is determined to be a valid code character in a website backdoor file. The word segmentation processing unit is used to determine the word segmentation category information to be segmented if the target character is determined to be a segmentation character to be segmented based on the current state of the second state machine and the word segmentation processing rule corresponding to the second current state; The risk determination unit is used to determine the degree of risk that the data file belongs to a website backdoor file with attack risks based on the word segmentation category information. The word segmentation processing unit includes: The first word segmentation processing unit is configured to determine the word segmentation category information corresponding to the third setting state if the second state machine is currently in the third setting state and the target character is determined to be a word character to be segmented based on the word segmentation processing rules corresponding to the target setting state. The third setting state is either the initial state set by the second state machine or a state that can trigger the determination of non-keyword word segmentation based on the characters before the target character determined by the second state machine. The second word segmentation processing unit is configured to, if the second state machine is currently in the fourth set state and the word segmentation processing rule corresponding to the target set state determines that the target character belongs to the word segmentation character that triggers word segmentation, cache the characters received by the second state machine after the target character, perform keyword matching based on the cached characters, and determine the word segmentation category information based on the keyword matching result. The fourth set state is a state that the second state machine determines based on the characters before the target character that can trigger keyword word segmentation.

9. The apparatus for determining document risk according to claim 8, characterized in that, Also includes: The pre-detection unit is used to detect whether there are risky characters in the segmented messages that indicate that the data file belongs to a website backdoor file after the message acquisition unit obtains the segmented messages from the data file; The message determination unit is used to determine the segmented message and other segmented messages obtained after the segmented message as segmented messages to be analyzed after detecting risk characters from the segmented message. The character determination unit is specifically used to determine the target character to be analyzed in the segmented message at the current time according to the order of the characters in the segmented message and input it into the first state machine.

Images