Risk file detection method and device, server and storage medium
By adding a predetermined identifier to the operation code input data of the file to be detected and detecting the input data of the execution function, the problem of inaccurate detection of webshell files in the prior art is solved, and the ability to accurately detect risk files without the need for predetermined rules is realized. , improves the real-time and accuracy of network security defense.
Patent Information
- Application Number
- CN202411158281.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-22
- Publication Date
- 2024-12-13
AI Technical Summary
In the prior art, webshell file detection relies on pre-made rules and cannot effectively detect features hidden by attackers through code obfuscation, etc., resulting in inaccurate detection.
By compiling the file to be detected into an operation code and adding a predetermined identifier to the input data during the execution of the operation code, it detects whether the identifier is carried in the input data of the specified execution function, thereby determining whether the file is a risk file.
It can accurately detect whether the file to be detected is a risk file without pre-order rules, which improves the accuracy and real-time detection and enhances network security defense capabilities.
Smart Images
Figure CN119128883A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of network security, and in particular to a risk file detection method and device, a server, and a storage medium. Background Art
[0002] Webshell is a malicious script file written in languages such as Active Server Pages (ASP), Hypertext Preprocessor (PHP), and Java Server Pages (JSP). Webshell can execute system commands, steal user data, delete web pages, modify homepages, etc., thereby controlling the server.
[0003] Currently, the main method for detecting webshell files is to formulate a large number of rules in advance, and then determine whether the web page file in the server is a webshell file based on the formulated rules. Summary of the invention
[0004] The inventors note that in the related art, webshell file detection is mainly based on predetermined rules. Since attackers usually use code obfuscation (e.g., shelling, encoding, encryption, etc.), the features of the webshell file cannot be effectively extracted, and thus the webshell file cannot be accurately detected based on the predetermined rules.
[0005] Accordingly, the present disclosure provides a risky file detection method, which can accurately detect whether a file to be detected is a risky file.
[0006] According to a first aspect of an embodiment of the present disclosure, a risk file detection method is provided, comprising: compiling a file to be detected to generate an operation code; adding a predetermined identifier to at least one input data in an input data source of the operation code; during the execution of the operation code, when the input data of a designated execution function includes data carrying the predetermined identifier, determining that the file to be detected is a risk file, wherein the input data of the designated execution function normally does not include the data carrying the predetermined identifier.
[0007] In some embodiments, during the execution of the operation code, a predetermined identifier is added to the data generated based on the data carrying the predetermined identifier.
[0008] In some embodiments, adding a predetermined identifier to data generated based on the data carrying the predetermined identifier includes: obtaining input data of a data transfer function; detecting whether the input data of the data transfer function includes the data carrying the predetermined identifier; and adding the predetermined identifier to data output by the data transfer function that is associated with the data carrying the predetermined identifier, when the input data of the data transfer function includes the data carrying the predetermined identifier.
[0009] In some embodiments, obtaining the input data of the data transfer function includes: obtaining the input data of the data transfer function through a pointer of the data transfer function.
[0010] In some embodiments, adding the predetermined identifier to the data associated with the data carrying the predetermined identifier output by the data transfer function includes: adding the predetermined identifier to a global attribute field of the data associated with the data carrying the predetermined identifier.
[0011] In some embodiments, adding a predetermined identifier to at least one input data in the input data source of the operation code includes: adding the predetermined identifier to a global attribute field of the at least one data.
[0012] In some embodiments, the input data source includes a data set obtained through at least one data acquisition method of GET, POST, and COOKIE.
[0013] In some embodiments, when the input data of the designated execution function includes the data carrying the predetermined identifier, an alarm message is sent.
[0014] In some embodiments, the file to be detected includes a PHP file.
[0015] In some embodiments, the designated execution function is located in any one of the module initialization phase, the request initialization phase, the request closing phase and the module closing phase in the life cycle of the PHP file.
[0016] In some embodiments, the risk file includes a webshell file.
[0017] According to a second aspect of an embodiment of the present disclosure, a risk file detection device is provided, comprising: a compilation module, configured to compile a file to be detected to generate an operation code; a tag adding module, configured to add a predetermined identifier to at least one input data in an input data source of the operation code; a file detection module, configured to determine that the file to be detected is a risk file when, during the execution of the operation code, the input data of a designated execution function includes data carrying the predetermined identifier, wherein the input data of the designated execution function does not normally include the data carrying the predetermined identifier.
[0018] According to a third aspect of an embodiment of the present disclosure, a risky file detection device is provided, comprising: a memory; a processor, coupled to the memory, the processor being configured to execute a method as described in any of the above embodiments based on instructions stored in the memory.
[0019] According to a fourth aspect of an embodiment of the present disclosure, a server is provided, comprising: a risky file detection device as described in any of the above embodiments.
[0020] According to a fifth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the method involved in any of the above embodiments is implemented.
[0021] According to a sixth aspect of an embodiment of the present disclosure, there is provided a computer program product, comprising computer instructions, wherein the computer instructions, when executed by a processor, implement the method involved in any of the above embodiments.
[0022] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0023] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.
[0024] Figure 1 A schematic diagram of a risk file detection method according to an embodiment of the present disclosure;
[0025] Figure 2 A schematic diagram of the life cycle of a PHP file according to an embodiment of the present disclosure;
[0026] Figure 3A schematic diagram of a flow chart of a method for adding a predetermined identifier according to an embodiment of the present disclosure;
[0027] Figure 4 This is a schematic diagram of the structure of a risky file detection device according to an embodiment of the present disclosure;
[0028] Figure 5 This is a schematic diagram of the structure of a risky file detection device according to another embodiment of the present disclosure;
[0029] Figure 6 The present invention is a schematic diagram of the structure of a server according to an embodiment of the present invention. DETAILED DESCRIPTION
[0030] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all of the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and is by no means intended to limit the present disclosure and its application or use. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.
[0031] Unless specifically stated otherwise, the relative arrangement of components and steps, the numerical expressions and numerical values set forth in these embodiments do not limit the scope of the present disclosure.
[0032] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.
[0033] Technologies, methods, and apparatus known to ordinary technicians in the relevant field may not be discussed in detail, but where appropriate, such technologies, methods, and apparatus should be considered part of the authorization specification.
[0034] In all examples shown and discussed herein, any specific values should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.
[0035] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.
[0036] Figure 1 The following is a flow chart of a risk file detection method according to an embodiment of the present disclosure. In some embodiments, the following risk file detection method is performed by a risk file detection device, including steps 11-13.
[0037] In step 11, the file to be detected is compiled to generate an operation code.
[0038] For example, the files to be detected include PHP files.
[0039] It should be noted that PHP is a general open source scripting language, whose syntax absorbs the characteristics of C language, Java and Perl, and is mainly suitable for the field of Web development. The syntax of PHP is a mixture of C, Java, Perl and PHP's own syntax, and it can execute dynamic web pages faster than CGI or Perl. Compared with other programming languages, the dynamic pages made by PHP are executed by embedding the program into HTML (HyperText Markup Language) documents, and the execution efficiency is higher than CGI, which completely generates HTML tags.
[0040] It should also be noted that each PHP file goes through two stages: the compilation stage and the execution stage. In the compilation stage, the file to be tested is parsed through lexical and grammatical analysis to generate an abstract syntax tree (Abstract Syntax Tree, referred to as AST), and then parsed into operation codes (OPCODE) based on the abstract syntax tree, and the operation codes are stored in memory. In the execution stage, the Zend engine executes these operation codes to complete the functions of the PHP file.
[0041] In step 12, a predetermined identifier is added to at least one input data in the input data source of the operation code.
[0042] For example, the predetermined tag may also be referred to as a tainted tag.
[0043] In some embodiments, a predetermined identifier is added to the global attribute field of the at least one data.
[0044] For example, when the file to be detected is a PHP file, the request initialization function PHP_RINIT_FUNCTION is used to add a predetermined identifier to a reserved flag bit in the global attribute field of the data.
[0045] In step 13, during the execution of the operation code, when the input data of the designated execution function includes data carrying a predetermined identifier, it is determined that the file to be detected is a risky file.
[0046] It should be noted that the input data of the designated execution function does not normally include data carrying a predetermined identifier. If the input data of the designated execution function includes data carrying a predetermined identifier, it indicates that the current file to be detected has an intrusion behavior on the designated execution function. In this case, the current file to be detected is determined to be a risky file.
[0047] For example, risky files include webshell files.
[0048] For example, the specified execution functions include eval, system, call_user_func, etc.
[0049] In some embodiments, the input data source includes a data set obtained through at least one data acquisition method of GET, POST, and COOKIE in HTTP (HyperText Transfer Protocol) input.
[0050] In some embodiments, when the input data of the designated execution function includes data carrying a predetermined identifier, an alarm message is sent so that the staff can promptly understand that the server is currently attacked by risky files.
[0051] In some embodiments, when the file to be detected is a PHP file, the specified execution function is located in any one of the module initialization phase, request initialization phase, request closing phase and module closing phase in the life cycle of the PHP file.
[0052] It should be noted here that Figure 2 As shown, in the life cycle of a PHP file, the execution process of the opcode will be analyzed in the module initialization (php_module_startup()) stage, the request initialization (php_request_startup()) stage, the request shutdown (php_request_shutdown()) stage and the module shutdown (php_module_shutdown()) stage. Therefore, by monitoring (hooking) the specified execution function in any of the module initialization stage, the request initialization stage, the request shutdown stage and the module shutdown stage, it is possible to effectively detect whether the file to be detected is a risky file.
[0053] exist Figure 2 In PHP, SAPI is an interface mechanism provided by PHP, which enables PHP to interact with other applications.
[0054] In the risk file detection method provided in the above embodiment of the present disclosure, the file to be detected is compiled to generate an operation code, a predetermined identifier is added to at least one input data in the input data source of the operation code, and during the execution of the operation code, it is detected whether the input data of the designated execution function includes data carrying the predetermined identifier. If the input data of the designated execution function includes data carrying the predetermined identifier, the file to be detected is determined to be a risk file. In this way, it is possible to accurately detect whether the file to be detected is a risk file without using a predetermined rule.
[0055] It should be noted that during the execution of the operation code, the predetermined identifier may be lost. For example, if data A carries a predetermined identifier and data B is obtained by processing data A, if the predetermined identifier is not added to data B, the predetermined identifier may be lost. Therefore, during the execution of the operation code, it is necessary to add a predetermined identifier to the data generated based on the data carrying the predetermined identifier.
[0056] Figure 3 The following is a flow chart of a method for adding a predetermined identifier according to an embodiment of the present disclosure. In some embodiments, the following method for adding a predetermined identifier is performed by a risky file detection device, including steps 31-33.
[0057] In step 31, the input number of the data transfer function is obtained.
[0058] For example, data transfer functions include substr, imploded, etc.
[0059] In some embodiments, input data of the data transfer function is obtained through a pointer (handler) of the data transfer function.
[0060] In step 32, it is detected whether the input data of the data transfer function includes data carrying a predetermined identifier.
[0061] In step 33, when the input data of the data transfer function includes data carrying the predetermined identifier, a predetermined identifier is added to the data output by the data transfer function and associated with the data carrying the predetermined identifier.
[0062] In some embodiments, a predetermined identifier is added to a global attribute field of data associated with data carrying a predetermined identifier.
[0063] For example, the input data of the data transfer function includes data A, data B and data C, wherein data A carries a predetermined identifier. If the data transfer function generates first output data D1 according to data A and data B, it is necessary to add a predetermined identifier to the first output data D1. If the data transfer function generates second output data D2 according to data B and data C, since the second output data D2 is not related to data A, it is not necessary to add a predetermined identifier to the second output data D2.
[0064] Figure 4 FIG. 1 is a schematic diagram of the structure of a risk file detection device according to an embodiment of the present disclosure. Figure 4 As shown, the risk file detection device includes a compilation module 41, a mark adding module 42 and a file detection module 43.
[0065] The compiling module 41 is configured to compile the file to be detected to generate an operation code.
[0066] For example, the files to be detected include PHP files.
[0067] It should be noted here that each PHP file goes through two stages: the compilation stage and the execution stage. In the compilation stage, the file to be tested is parsed through lexical and grammatical analysis to generate an abstract syntax tree, which is then parsed into opcodes based on the abstract syntax tree and stored in memory. In the execution stage, the Zend engine executes these opcodes to complete the functions of the PHP file.
[0068] The tag adding module 42 is configured to add a predetermined tag to at least one input data in the input data source of the operation code.
[0069] For example, the predetermined mark may also be referred to as a stain mark.
[0070] In some embodiments, a predetermined identifier is added to the global attribute field of the at least one data.
[0071] For example, when the file to be detected is a PHP file, the request initialization function PHP_RINIT_FUNCTION is used to add a predetermined identifier to a reserved flag bit in the global attribute field of the data.
[0072] The file detection module 43 is configured to determine that the file to be detected is a risk file when the input data of the designated execution function includes data carrying a predetermined identifier during the execution of the operation code.
[0073] It should be noted that the input data of the designated execution function does not normally include data carrying a predetermined identifier. If the input data of the designated execution function includes data carrying a predetermined identifier, it indicates that the current file to be detected has an intrusion behavior on the designated execution function. In this case, the current file to be detected is determined to be a risky file.
[0074] For example, risky files include webshell files.
[0075] For example, the specified execution functions include eval, system, call_user_func, etc.
[0076] In some embodiments, the input data source includes a data set obtained through at least one data acquisition method of GET, POST, and COOKIE in HTTP input.
[0077] In some embodiments, when the input data of the designated execution function includes data carrying a predetermined identifier, an alarm message is sent so that the staff can promptly understand that the server is currently attacked by risky files.
[0078] In some embodiments, when the file to be detected is a PHP file, the specified execution function is located in any one of the module initialization phase, request initialization phase, request closing phase and module closing phase in the life cycle of the PHP file.
[0079] It should be noted here that Figure 2 As shown, in the life cycle of a PHP file, the execution process of the opcode will be analyzed in the module initialization (php_module_startup()) stage, the request initialization (php_request_startup()) stage, the request shutdown (php_request_shutdown()) stage and the module shutdown (php_module_shutdown()) stage. Therefore, by monitoring (hooking) the specified execution function in any of the module initialization stage, the request initialization stage, the request shutdown stage and the module shutdown stage, it is possible to effectively detect whether the file to be detected is a risky file.
[0080] In the risk file detection device provided by the above embodiment of the present disclosure, the file to be detected is compiled to generate an operation code, a predetermined identifier is added to at least one input data in the input data source of the operation code, and during the execution of the operation code, it is detected whether the input data of the designated execution function includes data carrying the predetermined identifier, and if the input data of the designated execution function includes data carrying the predetermined identifier, the file to be detected is determined to be a risk file. In this way, it is possible to accurately detect whether the file to be detected is a risk file without using a predetermined rule.
[0081] It should be noted that during the execution of the operation code, the predetermined identifier may be lost. For example, if data A carries a predetermined identifier and data B is obtained by processing data A, if the predetermined identifier is not added to data B, the predetermined identifier may be lost. Therefore, during the execution of the operation code, it is necessary to add a predetermined identifier to the data generated based on the data carrying the predetermined identifier.
[0082] In some embodiments, the tag adding module 42 obtains an input number of a data transfer function.
[0083] For example, data transfer functions include substr, imploded, etc.
[0084] In some embodiments, input data of the data transfer function is obtained through a pointer (handler) of the data transfer function.
[0085] The tag adding module 42 detects whether the input data of the data transfer function includes data carrying a predetermined identifier. If the input data of the data transfer function includes data carrying a predetermined identifier, the tag adding module 42 adds a predetermined identifier to the data output by the data transfer function that is associated with the data carrying the predetermined identifier.
[0086] In some embodiments, the tag adding module 42 adds a predetermined identifier in a global attribute field of data associated with the data carrying the predetermined identifier.
[0087] For example, the input data of the data transfer function includes data A, data B and data C, wherein data A carries a predetermined identifier. If the data transfer function generates first output data D1 according to data A and data B, it is necessary to add a predetermined identifier to the first output data D1. If the data transfer function generates second output data D2 according to data B and data C, since the second output data D2 is not related to data A, it is not necessary to add a predetermined identifier to the second output data D2.
[0088] Figure 5 It is a structural schematic diagram of a risky file detection device according to another embodiment of the present disclosure.
[0089] like Figure 5 As shown, the risk file detection device 50 is in the form of a general-purpose computing device. The risk file detection device 50 includes a memory 51, a processor 52, and a bus 53 connecting different system components.
[0090] The memory 51 may include, for example, a system memory, a non-volatile storage medium, etc. The system memory may store, for example, an operating system, an application program, a boot loader, and other programs. The system memory may include a volatile storage medium, such as a random access memory (RAM) and / or a cache memory. The non-volatile storage medium may store, for example, instructions of a corresponding embodiment of at least one risk file detection method being executed. The non-volatile storage medium includes, but is not limited to, a disk storage, an optical storage, a flash memory, etc.
[0091] The processor 52 can be implemented by a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistors, etc. Discrete hardware components. Accordingly, each module such as an acquisition module, a calculation module, and an adjustment module can be implemented by a central processing unit (CPU) running instructions in a memory that execute corresponding steps, or by a dedicated circuit that executes corresponding steps.
[0092] For example, the processor 52 is configured to execute instructions stored in the memory to implement the following Figure 1 or Figure 3 The method of any one of the embodiments.
[0093] The bus 33 may use any of a variety of bus structures, including, but not limited to, an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, and a Peripheral Component Interconnect (PCI) bus.
[0094] The interfaces 54, 55, 56 of the risk file detection device 50 and the memory 51 and the processor 52 can be connected via a bus 53. The input and output interface 54 can provide a connection interface for input and output devices such as a display, a mouse, and a keyboard. The network interface 55 provides a connection interface for various networked devices. The storage interface 56 provides a connection interface for external storage devices such as a floppy disk, a USB flash drive, and an SD card.
[0095] Here, various aspects of the present disclosure are described with reference to flowcharts and / or block diagrams of methods, devices, and computer program products according to embodiments of the present disclosure. It should be understood that each frame of the flowchart and / or block diagram and the combination of frames can be implemented by computer-readable program instructions.
[0096] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable device to produce a machine, so that the processor executes the instructions to produce means for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.
[0097] These computer-readable program instructions may also be stored in a computer-readable memory, which cause the computer to work in a specific manner to produce an article of manufacture, including instructions for implementing the functions specified in one or more blocks in the flowchart and / or block diagram.
[0098] The present disclosure can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects.
[0099] The present disclosure also provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the following is implemented: Figure 1 or Figure 3 The method of any one of the embodiments.
[0100] The present disclosure also provides a computer program product, including computer instructions, wherein when the computer instructions are executed by a processor, the following is achieved: Figure 1 or Figure 3 The method of any one of the embodiments.
[0101] Figure 6 FIG. 1 is a schematic diagram of the structure of a server according to an embodiment of the present disclosure. Figure 6As shown, the server 60 includes a risk file detection device 61, and the risk file detection device 61 is Figure 4 or Figure 5 The risky file detection device shown in any one of the embodiments.
[0102] In the above embodiment of the present disclosure, by compiling the file to be detected to generate an operation code, adding a predetermined identifier to at least one input data in the input data source of the operation code, during the execution of the operation code, detecting whether the input data of the designated execution function includes data carrying the predetermined identifier, if the input data of the designated execution function includes data carrying the predetermined identifier, the file to be detected is determined to be a risk file, and in this case, a danger warning message is issued in a timely manner. In this way, it is possible to accurately detect whether the file to be detected is a risk file without using a predetermined rule. Therefore, compared with the traditional static feature detection method, the risk file detection method provided by the present disclosure is more accurate and real-time, and can provide strong support for network security defense.
[0103] In some embodiments, the functional modules described above can be implemented as a general-purpose processor, a programmable logic controller (PLC), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components or any appropriate combination thereof for performing the functions described in the present disclosure.
[0104] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware or by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.
[0105] The description of the present disclosure is given for the purpose of illustration and description, and is not intended to be exhaustive or to limit the present disclosure to the disclosed form. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiments are selected and described in order to better illustrate the principles and practical applications of the present disclosure, and to enable those of ordinary skill in the art to understand the present disclosure and thereby design various embodiments with various modifications suitable for specific uses.
Claims
1. A risk file detection method, comprising: Compile the file to be tested to generate operation code; adding a predetermined identifier to at least one input data in the input data source of the operation code; During the execution of the operation code, when the input data of the designated execution function includes the data carrying the predetermined identifier, the file to be detected is determined to be a risky file, wherein the input data of the designated execution function normally does not include the data carrying the predetermined identifier.
2. The risk file detection method according to claim 1, further comprising: During the execution of the operation code, a predetermined identifier is added to the data generated based on the data carrying the predetermined identifier.
3. The risk file detection method according to claim 2, wherein: The adding a predetermined identifier to the data generated based on the data carrying the predetermined identifier comprises: Get input data of data transfer function; Detecting whether the input data of the data transfer function includes the data carrying the predetermined identifier; In a case where the data carrying the predetermined identifier is included in the input data of the data transfer function, the predetermined identifier is added to the data output by the data transfer function and associated with the data carrying the predetermined identifier.
4. The risk file detection method according to claim 3, wherein: The input data of the data transfer function includes: The input data of the data transfer function is obtained through the pointer of the data transfer function.
5. The risk file detection method according to claim 3, wherein: The adding the predetermined identifier to the data output by the data transfer function and associated with the data carrying the predetermined identifier comprises: The predetermined identifier is added to the global attribute field of the data associated with the data carrying the predetermined identifier.
6. The risk file detection method according to any one of claims 1 to 5, wherein: The adding a predetermined identifier to at least one input data in the input data source of the operation code comprises: The predetermined identifier is added to the global attribute field of the at least one data.
7. The risk file detection method according to any one of claims 1 to 5, wherein: The input data source includes a data set obtained through at least one data acquisition method of GET, POST, and COOKIE.
8. The risk file detection method according to any one of claims 1 to 5, further comprising: When the input data of the designated execution function includes the data carrying the predetermined identifier, an alarm message is sent.
9. The risk file detection method according to any one of claims 1 to 5, wherein: The files to be detected include PHP files.
10. The risk file detection method according to claim 9, wherein: The designated execution function is located in any one of the module initialization phase, the request initialization phase, the request closing phase and the module closing phase in the life cycle of the PHP file.
11. The method according to any one of claims 1 to 5, wherein: The risk files include webshell files.
12. A risk file detection device, comprising: A compiling module, configured to compile the file to be detected to generate an operation code; a tag adding module, configured to add a predetermined tag to at least one input data in the input data source of the operation code; The file detection module is configured to determine that the file to be detected is a risk file when, during the execution of the operation code, the input data of the designated execution function includes data carrying the predetermined identifier, wherein the input data of the designated execution function does not normally include the data carrying the predetermined identifier.
13. A risk file detection device, comprising: Memory; A processor is coupled to the memory, and the processor is configured to execute the risk file detection method according to any one of claims 1 to 11 based on instructions stored in the memory.
14. A server, comprising: The risky document detection device as claimed in claim 12 or 13.
15. A computer-readable storage medium, wherein: The computer-readable storage medium stores computer instructions, and when the instructions are executed by a processor, the risk file detection method according to any one of claims 1 to 11 is implemented.
16. A computer program product, comprising computer instructions, wherein when the computer instructions are executed by a processor, the risk file detection method according to any one of claims 1 to 11 is implemented.