Security detection method, device, equipment, medium and product

Abstract

The invention provides a security detection method and device, equipment, a medium and a product, and the method comprises the steps: obtaining a first code file related to a target file event in response to the detection of the target file event of first computing equipment; wherein the first code file is used for being executed in the first computing device; generating a first prompt word; wherein the first prompt word comprises a first code file; indicating information for detecting the following target data: external input in the first code file, a target execution function in the first code file and a transmission path of the external input in the first code file; the information is used for indicating a detection mode for detecting the first code file based on the target data; and sending the first prompt word to the first language model, and receiving a detection result of the first code file returned by the first language model. According to the method, whether the code file is related to the rebound shell behavior or not is accurately judged, rebound shell detection of cross-programming languages is achieved, and expansibility and applicability are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a security detection method, device, electronic device, computer-readable storage medium, and computer program product. Background Art

[0002] With the continuous development of computer technology, security protection products for security detection have emerged. Security protection products can detect physical computing devices such as computers and hosts or virtual computing devices such as containers to ensure safe operation. In actual applications, security protection products can include cloud workload protection platform (CWPP), host-based intrusion detection system (HIDS), endpoint detection and response (EDR), container security platform (CSP), etc.

[0003] Security protection products can perform multiple tests on computing devices. For example, security protection products can detect reverse shells. Reverse shells can be understood as attack methods that use technical means to enable the target computing device (also called the controlled end) to actively connect to the attacker's computing device (also called the control end), thereby allowing the control end to remotely control the controlled end.

[0004] Specifically, a listening port is set on the control end, and a shell command is executed on the controlled end to create a reverse connection to the listening port of the control end, thereby realizing the connection between the controlled end and the control end. In a script-type rebound shell, the shell command executed by the controlled end can be in the form of a code file, that is, the controlled end executes the code file to establish a reverse connection from the controlled end to the control end, thereby realizing the remote control of the control end over the controlled end.

[0005] Since the code files in script-type rebound shells are usually embedded in normally running system processes, they are difficult to identify through traditional signature detection or traffic analysis methods. At the same time, since the code files can be written in different types of programming languages, the detection of script-type rebound shells is particularly complex. The industry is in urgent need of a flexible and highly applicable security detection method. Summary of the invention

[0006] The present application provides a security detection method. The method can accurately determine whether a code file has a rebound shell risk, and realizes rebound shell detection across programming languages, improving scalability and applicability. The present application also provides a device, an electronic device, a computer-readable storage medium, and a computer program product corresponding to the above method.

[0007] In a first aspect, the present application provides a security detection method, the method comprising:

[0008] In response to detecting a target file event of a first computing device, obtaining a first code file related to the target file event; wherein the first code file is used to be executed in the first computing device;

[0009] Generate a first prompt word;

[0010] The first prompt word includes: the first code file; information indicating detection of the following target data: external input in the first code file, target execution function in the first code file, and transmission path of the external input in the first code file; and information indicating detection method of detecting the first code file based on the target data;

[0011] The first prompt word is sent to a first language model, and a detection result of the first code file returned by the first language model is received.

[0012] In a second aspect, the present application provides a safety detection device, the device comprising:

[0013] an acquisition module, configured to acquire, in response to detecting a target file event of a first computing device, a first code file related to the target file event; wherein the first code file is used to be executed in the first computing device;

[0014] A generating module, configured to generate a first prompt word; wherein the first prompt word includes: the first code file; information indicating detection of the following target data: an external input in the first code file, a target execution function in the first code file, and a transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data;

[0015] The communication module is used to send the first prompt word to the first language model and receive the detection result of the first code file returned by the first language model.

[0016] In a third aspect, the present application provides an electronic device, the electronic device comprising a processor and a memory. The processor and the memory communicate with each other. The processor is used to execute instructions stored in the memory so that the electronic device performs the security detection method in the first aspect or any implementation of the first aspect.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, wherein the instructions instruct an electronic device to execute the security detection method described in the first aspect or any one of the implementations of the first aspect.

[0018] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on an electronic device, enables the electronic device to execute the security detection method described in the first aspect or any one of the implementations of the first aspect.

[0019] Based on the implementations provided in the above aspects, this application can also be further combined to provide more implementations.

[0020] It can be seen from the above technical solutions that this application has the following advantages:

[0021] The present application provides a security detection method. In response to detecting a target file event of a first computing device, the method obtains a first code file related to the target file event, wherein the first code file is used to be executed in the first computing device, and then generates a first prompt word, wherein the first prompt word includes the first code file; information indicating detection of the following target data: external input in the first code file, a target execution function in the first code file, and a transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data, sending the first prompt word to a first language model, and receiving a detection result of the first code file returned by the first language model.

[0022] In this method, for the code file executed in the first computing device, the natural language processing capability of the language model is used to detect the external input, data flow path and command execution behavior in the code file. On the one hand, combined with the specific information of the code file, it is accurately determined whether the code file is related to the rebound shell behavior. On the other hand, the language model is used to realize cross-programming language rebound shell detection, thereby improving scalability and applicability. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical method of the embodiments of the present application, the drawings required for use in the embodiments are briefly introduced below.

[0024] Figure 1A schematic diagram of a safety detection method provided in an embodiment of the present application;

[0025] Figure 2 A schematic diagram of a safety detection method provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of the structure of a safety detection device provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0028] The terms "first" and "second" in the embodiments of the present application are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0029] First, some technical terms and application scenarios involved in the embodiments of this application are introduced.

[0030] With the continuous development of computer technology, security protection products for security detection and protection of physical computing devices such as computers and hosts or virtual computing devices such as containers have emerged. Security protection products can perform multi-faceted security detection for a variety of operating scenarios. For example, the security protection product can be a cloud workload protection platform (CWPP), which can detect host security and network security. For another example, the security protection product can be a host-based intrusion detection system (HIDS), which can perform security detection on the behavior and status of the computer system. For another example, the security protection product can be an endpoint detection and response (EDR), which can perform security detection on the system-level behavior of the endpoint. For another example, the security protection product can be a container security platform (CSP), which can provide multi-faceted security detection for containers.

[0031] In some examples, security products can detect reverse shells, which can be understood as an attack method that uses technical means to make the target computing device (also called the controlled end) actively connect to the attacker's computing device (also called the control end), thereby allowing the control end to remotely control the controlled end.

[0032] Specifically, a listening port is set on the control end, and a shell command is executed on the controlled end to create a reverse connection to the listening port of the control end, thereby realizing the connection between the controlled end and the control end. In a script-type rebound shell, the shell command executed by the controlled end can be in the form of a code file, that is, the controlled end executes the code file to establish a reverse connection from the controlled end to the control end, thereby realizing the remote control of the control end over the controlled end.

[0033] Since the code files in script-type rebound shells are usually embedded in normally running system processes, they are difficult to identify through traditional signature detection or traffic analysis methods. In related technologies, taint analysis technology is usually used to detect rebound shells. Among them, the core idea of ​​taint analysis technology is: for the code files of the controlled end, mark the external inputs that may come from untrusted sources (also called tainted data), detect the propagation path of tainted data in the code files, and when the tainted data passes through the key function (also called the sink function), it indicates that the code file may be used to establish a reverse connection, triggering an alarm related to the rebound shell.

[0034] Generally, when using taint analysis technology to detect rebound shells, the code file is traversed through the abstract syntax tree (AST) to generate a character (token) list corresponding to the code file. During the detection process, the external input pre-configured in the token list (such as user input, network request, etc.) is marked as tainted data, and the propagation path of the tainted data is recorded by detecting the propagation rules pre-configured in the token list (such as assignment functions, etc.). When the tainted data passes through the key functions pre-configured in the token list (such as command execution functions, file operation functions, etc.), an alarm is triggered, indicating that the code file may be related to the rebound shell behavior.

[0035] However, the above-mentioned rebound shell detection method based on the abstract syntax tree has the following defects: First, the above-mentioned method relies on pre-configured tainted data, propagation rules and key functions, and the real-time performance of security detection is poor. Secondly, the anti-bypass capability of the above-mentioned method is weak, and it is difficult to achieve effective propagation path detection for encoding functions, decoding functions, encryption functions, etc. in code files. In addition, since code files can be written in different types of programming languages, the above-mentioned method needs to configure different tainted data, propagation rules and key functions for different types of programming languages, which greatly increases the complexity of security detection and has poor applicability and scalability.

[0036] In view of this, the present application provides a security detection method, which, in response to detecting a target file event of a first computing device, obtains a first code file related to the target file event, wherein the first code file is used to be executed in the first computing device, and then generates a first prompt word, wherein the first prompt word includes the first code file; information indicating detection of the following target data: external input in the first code file, target execution function in the first code file, and transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data, sends the first prompt word to a first language model, and receives the detection result of the first code file returned by the first language model.

[0037] In this method, for the code file executed in the first computing device, the natural language processing capability of the language model is used to detect the external input, data flow path and command execution behavior in the code file. On the one hand, combined with the specific information of the code file, it is accurately determined whether the code file is related to the rebound shell behavior. On the other hand, the language model is used to realize cross-programming language rebound shell detection, thereby improving scalability and applicability.

[0038] To facilitate understanding of the technical solution provided by the embodiments of the present application, the following will be described in conjunction with the accompanying drawings. Figure 1 The flowchart of a safety detection method provided in the embodiment of the present application is shown, and the method specifically includes:

[0039] S101: In response to detecting a target file event of a first computing device, obtaining a first code file related to the target file event.

[0040] In the embodiment of the present application, a security check is performed on the script-type rebound shell. Considering that in the script-type rebound shell, the controlled end executes the shell command by running the code file to establish a reverse connection from the controlled end to the control end, therefore, in the embodiment of the present application, by detecting the system file event, the code file related to the first computing device is obtained, and then the security check is performed on the code file.

[0041] The first computing device can be understood as a device for security detection. In other words, in the embodiment of the present application, a security detection is performed on whether there is a rebound shell behavior in the first computing device. In some embodiments, the first computing device can be a physical computing device such as a computer or a host. In other embodiments, the first computing device can also be a virtual computing device such as a virtual machine or a container. The embodiment of the present application does not limit this.

[0042] The target file event can be understood as a file event generated in the first computing device. For example, the target file event can be a file creation event in the first computing device, or a file modification event for an existing file in the first computing device.

[0043] The first code file can be understood as a file associated with the target file event. For example, when the target file event is a file creation event, the first code file can be a code file newly created in the first computing device. For another example, when the target file event is a file modification event, the first code file can be a code file to be modified in the first computing device.

[0044] In the embodiment of the present application, the first code file is used to be executed in the first computing device, that is, the first code file may be a code file running in the first computing device.

[0045] The first code file may include executable instructions for running in the first computing device. For example, the first code file may be a script file. The present application embodiment does not limit the programming language of the first code file. For example, the programming language of the first code file may be Java, Python, PHP, etc.

[0046] It should be noted that the embodiments of the present application do not limit the method for detecting the target file event of the first computing device. In some embodiments, the file directory of the first computing device can be detected based on the fanotify technology to achieve the detection of the target file event of the first computing device. In other embodiments, the target file event of the first computing device can also be detected by an external file detection tool. In other embodiments, when the security detection method provided by the embodiments of the present application is executed by a security protection product, the target file event of the first computing device can also be detected by the file detection function provided by the security protection product.

[0047] In some embodiments, considering that the number of detected target file events with the first computing device may be large, in order to improve the security detection efficiency, the first code file may also be screened and filtered. Figure 2As shown, at least one of the following operations is performed on the first code file: matching the first code file with the file set and determining the file size of the first code file.

[0048] The file set includes multiple files. For example, the file set may include multiple files (e.g., multiple business files) that have passed the security detection in the first computing device. In other words, the file set can be understood as a whitelist file set. In this way, by matching the first code file with the file set, it is determined whether the first code file belongs to a known safe file in the first computing device. If the first code file hits the file set, that is, the match is successful, the first code file is discarded without the need for subsequent security detection processing.

[0049] In some embodiments, a file hash of the first code file may be determined, and the file hash of the first code file may be compared with file hashes of multiple files in a file set, and the first code file may be matched with the file set by utilizing the uniqueness of the file hash.

[0050] On the other hand, considering that the file size of the code file used to establish the reverse connection is usually small, and that the subsequent security detection processing for the code file with a large file size consumes too many computing resources, the file size of the first code file can also be determined, and the first code file can be screened based on the file size of the first code file. Specifically, if the file size of the first code file is not less than the set threshold, the first code file is discarded, and there is no need to perform subsequent security detection processing. In this way, computing resources are saved and more targeted security detection is achieved.

[0051] The embodiment of the present application does not impose any restrictions on the setting threshold of file size. In actual applications, it can be set according to the file upload rate and the file processing rate to avoid processing timeouts and the like.

[0052] S102: Generate a first prompt word.

[0053] In the embodiment of the present application, security detection is performed with the help of a first language model. The first language model has natural language processing capabilities, can understand the meaning of natural language, and process different types of natural language tasks. For example, the first language model can be a deep learning model trained using text data. In other words, the natural language processing capabilities of the first language model are used to understand the idea of ​​detecting a rebound shell for the first computing device, and to implement security detection for the first code file.

[0054] In a specific implementation, the first language model performs security detection on the first code file based on prompt learning. Among them, prompt words can be used to guide the language model to perform specific outputs in generative tasks (such as text generation tasks, question-answering tasks, and dialogue tasks). By configuring prompt words, the language model is helped to understand the background and requirements of the task, so that the language model can handle different types of natural language processing tasks without retraining the language model, thereby increasing the scalability and flexibility of the language model.

[0055] In an embodiment of the present application, the first prompt word may include: a first code file; information indicating detection of the following target data: external input in the first code file, a target execution function in the first code file, and a transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data.

[0056] That is, the first prompt word includes three parts of information: the first part is the first code file, the second part is information indicating that the first language model detects the target data in the first code file, and the third part is information indicating that the first language model generates a detection result based on the target data.

[0057] The target data specifically includes external input, target execution function and propagation path. That is, the first prompt word instructs the first language model to perform taint analysis on the first code file, identify the external input in the first code file, the propagation path of the external input in the first code file, and the target execution function related to the command execution.

[0058] The information in the first prompt word indicating detection of external input in the first code file may include: information indicating detection of input functions in the first code file, and information indicating detection of external resource calls in the first code file. In this way, detection can be achieved for both explicit input functions and indirect calls to external resources.

[0059] The information in the first prompt word indicating detection of the target execution function in the first code file may include: information indicating detection of command execution in the first code file, and information indicating detection of file operations in the first code file. In other words, the target execution function may be a sink function in taint analysis.

[0060] The information in the first prompt word indicating the transmission path of the detected external input in the first code file may include: information indicating the propagation path of the detected external input in the first code file after passing through at least one of the following operations: assignment operation, encoding operation, decoding operation, encryption operation and conversion operation.

[0061] That is to say, by configuring different propagation methods of external input in the first prompt word, the first language model can detect the propagation path of the external input from the first code file through different propagation methods based on the prompt ability of the first prompt word, thereby avoiding defects that are easily missed in traditional taint analysis for encoding, decoding, encryption and other operations, and effectively dealing with complex bypass techniques such as encoding bypass, multi-file combination, and traffic encryption to reduce detection blind spots.

[0062] Furthermore, since the first prompt word includes information indicating a detection method of the first language model for detecting the first code file based on the target data, the first language model can determine whether the first code file is used to establish a reverse connection and whether it is related to a rebound shell behavior based on the prompt capability of the first prompt word, thereby achieving security detection of the first code file.

[0063] In some possible implementations, considering the actual process of using taint analysis technology to detect rebound shells, the detection method of detecting the first code file based on target data can be: in response to satisfying the following conditions, determining that the first code file has failed the detection: there are external inputs and target execution functions in the first code file, and, based on the transmission path of the external input in the first code file, determining that the input parameters of the target execution function are derived from the external input.

[0064] In other words, the first language model can determine whether external input and target execution function are detected in the first code file based on the prompt ability of the first prompt word. When external input and target execution function are detected in the first code file, and the propagation path of the external input indicates that the input parameters of the target execution function come from the external input, that is, the propagation path of the external input includes the target execution function, indicating that when the target execution function of the first code file is executed, the data related to the external input will be executed together, and there is a possibility of establishing a reverse connection. Therefore, the first code file has the possibility of a rebound shell and fails the detection.

[0065] In this way, by configuring a specific detection method for the first code file in the first prompt word, based on the prompt capability of the first prompt word, the first language model is informed how to perform security detection on the first code file, so that the first language model can automatically identify whether there is content related to the rebound shell in the first code file, and determine whether the first code file passes the security detection.

[0066] As described above, in some embodiments, the first code file is screened and filtered. In this case, a first prompt word is generated in response to at least one of the following situations: the first code file is not successfully matched with the file set and the file size of the first code file is less than a set threshold.

[0067] In some embodiments, in order to further improve the accuracy of security detection, auxiliary information can be retrieved based on retrieval-augmented generation (RAG) technology, so that the first language model can refer to the auxiliary information to generate a more accurate detection result. Figure 2 As shown, auxiliary information representing natural language content is obtained from the security detection knowledge base, and a first prompt word including the auxiliary information is generated. The auxiliary information includes: information describing external input in the code file, information describing the determined propagation path, and information describing the input target execution function in the code file.

[0068] Among them, the security detection knowledge base stores multiple auxiliary information related to the detection of rebound shells using taint analysis technology. By configuring the auxiliary information in the first prompt word, the first language model can more comprehensively learn how to identify external inputs in the first code file, how to determine the propagation path of external inputs in the first code file, and how to identify target execution functions in the first code file, making the detection of the first code file more accurate.

[0069] Moreover, since the auxiliary information in the security detection knowledge base is described in natural language and is not limited to a specific programming language, with the help of the natural language processing capabilities of the first language model, we can learn the analytical ideas of identifying external inputs, determining propagation paths, and identifying target execution functions. In the first code files of different programming languages, we can realize the detection of target data and achieve cross-language and cross-environment security detection.

[0070] To illustrate with an example, the first prompt word can be as follows:

[0071] "You are a code file rebound shell detection expert, specializing in analyzing potential rebound shell vulnerabilities in code files, especially those involving external input, command execution, and data transfer, and generating code file detection results through external input, command execution, and data transfer.

[0072] The code file is as follows:

[0073] {{First code file}}

[0074] ###Skill 1: Detect external input

[0075] Detect whether there is a function that receives external input in the code file

[0076] For possible methods, please refer to the Security Detection Knowledge Base

[0077] ###Skill 2: Detect command execution

[0078] Detect whether there is a command execution function in the code

[0079] For possible methods, please refer to the Security Detection Knowledge Base

[0080] ###Skill 3: Detect data transmission

[0081] Check whether the parameters of the execution command are passed in the middle and finally come from external input

[0082] For possible methods, please refer to the Security Detection Knowledge Base

[0083] The security detection knowledge base is as follows:

[0084] a. Variable assignment, related to skill 3: external input is assigned to new variables, causing taint to spread.

[0085] b. Parameter passing, related to skill 3: When a function is called, external input is propagated into the function as parameters.

[0086] c. Encoding / decoding, related to skill 3: Data is converted through encoding (such as Base64, URL encoding) or decoding, and the taint is propagated.

[0087] d. Type / format conversion, related to skill 3: Conversion of data type or format, such as string to integer, the taint is still propagated.

[0088] e. Collection operations, related to skill 3: Tainted data is stored in data structures such as arrays and lists, and propagated through access and operations.

[0089] f. Input / output binding, related to skill 3: External input interacts with the program and propagates through standard input / output, file reading and writing, etc.

[0090] g. File and environment variable operations, related to skill 3: External input pollutes files or environment variables, affecting subsequent operations of the program.

[0091] h. Pipes / streams, related to skill 3: Tainted data is passed to other processes or program modules through pipes or streams.

[0092] i. Serialization / deserialization, related to skill 3: During the serialization and deserialization of data, taints are still transmitted.

[0093] j. Regular expression replacement, related to skill 3: When regular expression replacement is used, the data is modified but the taint continues to propagate.

[0094] k. Closures and callback functions, related to skill 3: external variable state propagation taint carried in closures or callback functions. "

[0095] Among them, "The code file is as follows: {{first code file}}" is the first code file included in the first prompt word, "Skill 1: Detect external input", "Skill 2: Detect command execution" and "Skill 3: Detect data transfer" are the information in the first prompt word indicating the detection of target data, "Generate detection results of code files through external input, command execution and data transfer" is the information in the first prompt word indicating the detection method of detecting the first code file based on target data, and the information in the "security detection knowledge base" is the auxiliary information in the first prompt word.

[0096] In the embodiment of the present application, by configuring the first prompt word, the first language model can combine the first prompt word to perform accurate and comprehensive stain analysis on the first code file.

[0097] S103: Send the first prompt word to the first language model, and receive the detection result of the first code file returned by the first language model.

[0098] By calling the first language model and inputting the first prompt word into the first language model, the first language model performs taint analysis on the first code file under the prompt capability of the first prompt word, identifies the external input and the target execution function in the first code file, detects the propagation path of the external input in the first code file, and generates the detection result of the first code file based on the detected target data.

[0099] Specifically, the detection result of the first code file may include at least one of the following: information indicating whether the first code file passes the detection, information describing an analysis process for generating the detection result, and a code snippet in the first code file related to the detection result.

[0100] That is to say, the detection result of the first code file returned by the first language model may carry a variety of information. Among them, the information representing whether the first code file passes the detection can be understood as a judgment conclusion, for example, whether the first code file passes the detection or the first code file fails the detection. The first code file passing the detection means that the first code file is not a code file for establishing a reverse connection, and the first code file does not have a rebound shell behavior.

[0101] The information describing the analysis process of generating the detection result can be understood as the judgment idea, and the code snippet related to the detection result in the first code file can be understood as the basis code snippet. In other words, the first language model can input the idea and basis for presenting the judgment result together, indicating the specific analysis process of the first language model.

[0102] The detection result of the first code file may be returned in the form of a structure. For example, the detection result of the first code file may be as follows:

[0103]

[0104]

[0105] In this way, with the help of the natural language processing capability of the first language model, the overall semantics and code structure of the first code file are analyzed to determine whether the first code file is used to establish a reverse connection and whether there is a risk of a rebound shell. There is no need to adapt to different programming languages, and cross-language and cross-environment security detection can be achieved.

[0106] Further, continue as Figure 2 As shown, in response to the detection result indicating that the first code file fails the detection, an alarm event is generated according to the detection result, and information associated with the alarm event is presented.

[0107] The information associated with the alarm event may include the detection result of the first code file, information of the first computing device, disposal information for handling rebound shell, etc. In this way, when the first code file fails the detection and the first code file may have rebound shell behavior, the alarm event is triggered in time, so that the user (for example, a security operator) can handle the alarm in time to ensure the safe operation of the first computing device.

[0108] Furthermore, since the embodiment of the present application uses a natural language model for security detection, considering that the detection result of the first code file generated by the first language model may deviate from the actual needs of the user, it can also support users (such as security operators) to analyze and judge alarm events. Figure 2 As shown, a determination operation for an alarm event is received, and in response to the determination operation indicating that information associated with the alarm event is erroneous, at least one of the following operations is performed: updating information associated with the alarm event, updating a security detection knowledge base, and adding a first code file to a file collection.

[0109] That is to say, if the alarm event generated according to the detection result is correct, no additional operation is required. If the alarm event generated according to the detection result has errors, such as errors in the judgment conclusion and attribution of the first code file, the user can make corrections based on the currently presented alarm event associated information to form updated alarm event associated information.

[0110] In addition, if there is an error in the alarm event generated based on the detection result, for example, there is an error in the judgment idea of ​​the first code file, the user can correct and amend multiple auxiliary information related to the detection of rebound shells using taint analysis technology in the security detection knowledge base to form an updated security detection knowledge base.

[0111] In addition, if the alarm event generated according to the detection result has an error, for example, the first code file belongs to a business file, the first code file can be added to the file set, and the whitelist file set can be updated.

[0112] In this method, for the code file executed in the first computing device, the natural language processing capability of the language model is used to detect the external input, data flow path and command execution behavior in the code file. On the one hand, combined with the specific information of the code file, it is accurately determined whether the code file is related to the rebound shell behavior. On the other hand, the language model is used to realize cross-programming language rebound shell detection, thereby improving scalability and applicability.

[0113] Combination of the above Figure 1 and Figure 2 The security detection method provided in the embodiment of the present application is introduced in detail. The following will introduce the device and equipment provided in the embodiment of the present application in conjunction with the accompanying drawings.

[0114] See also Figure 3 The structural diagram of the safety detection device shown in FIG. 30 includes:

[0115] An acquisition module 301 is configured to acquire a first code file related to a target file event detected by a first computing device in response to the target file event being detected by the first computing device; wherein the first code file is configured to be executed in the first computing device;

[0116] A generating module 302 is used to generate a first prompt word; wherein the first prompt word includes: the first code file; information indicating detection of the following target data: an external input in the first code file, a target execution function in the first code file, and a transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data;

[0117] The communication module 303 is used to send the first prompt word to the first language model, and receive the detection result of the first code file returned by the first language model.

[0118] In some possible implementations, the detection method of detecting the first code file based on the target data includes:

[0119] In response to satisfying the following conditions, it is determined that the first code file has failed detection: there are external inputs and target execution functions in the first code file, and based on a transmission path of the external input in the first code file, it is determined that an input parameter of the target execution function is derived from the external input.

[0120] In some possible implementations, the information indicating the detection of a transmission path of the external input in the first code file includes:

[0121] Information indicating detection of a propagation path of the external input after passing through at least one of the following operations in the first code file: an assignment operation, an encoding operation, a decoding operation, an encryption operation, and a conversion operation.

[0122] In some possible implementations, the apparatus 30 further includes a retrieval module, and the retrieval module is configured to:

[0123] Acquire auxiliary information representing natural language content from a security detection knowledge base; wherein the auxiliary information includes: information describing external input in a code file, information describing a determined propagation path, and information describing an input target execution function in a code file;

[0124] The first prompt word also includes: the auxiliary information.

[0125] In some possible implementations, the device 30 further includes a preprocessing module, and the preprocessing module is used to:

[0126] Perform at least one of the following operations on the first code file: match the first code file with a file set and determine the file size of the first code file; wherein the file set includes a plurality of files;

[0127] The generating module 302 is specifically used for:

[0128] In response to at least one of the following situations, a first prompt word is generated: the first code file is not successfully matched with the file set and the file size of the first code file is smaller than a set threshold.

[0129] In some possible implementations, the detection result of the first code file includes at least one of the following: information indicating whether the first code file passes the detection, information describing an analysis process for generating the detection result, and a code snippet in the first code file related to the detection result.

[0130] In some possible implementations, the apparatus 30 further includes an alarm module, and the alarm module is configured to:

[0131] In response to the detection result indicating that the first code file fails the detection, generating an alarm event according to the detection result;

[0132] Present information associated with the alarm event.

[0133] In some possible implementations, the apparatus 30 further includes an updating module, and the updating module is configured to:

[0134] Receiving a determination operation for the alarm event;

[0135] In response to the determination operation indicating that the information associated with the alarm event is erroneous, at least one of the following operations is performed: updating the information associated with the alarm event, updating a security detection knowledge base, and adding the first code file to a file set.

[0136] The safety detection device 30 according to the embodiment of the present application may correspond to the method described in the embodiment of the present application, and the above and other operations and / or functions of each module / unit of the safety detection device 30 are respectively to achieve Figure 1 For the sake of brevity, the corresponding processes of each method in the illustrated embodiment are not described in detail here.

[0137] The present application also provides an electronic device. The electronic device is specifically used to implement Figure 3 The function of the safety detection device 30 in the illustrated embodiment.

[0138] Figure 4 A schematic diagram of the structure of an electronic device 400 is provided. Figure 4 As shown, the electronic device 400 includes a bus 401, a processor 402, a communication interface 403 and a memory 404. The processor 402, the memory 404 and the communication interface 403 communicate with each other via the bus 401.

[0139] The bus 401 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0140] The processor 402 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0141] The communication interface 403 is used for communicating with the outside. For example, the communication interface 403 can be used for communicating with a terminal.

[0142] The memory 404 may include a volatile memory, such as a random access memory (RAM). The memory 404 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0143] The memory 404 stores executable codes, and the processor 402 executes the executable codes to perform the aforementioned security detection method.

[0144] Specifically, in implementing Figure 3 In the case of the embodiment shown, and Figure 3 When each module or unit of the safety detection device 30 described in the embodiment is implemented by software, the execution Figure 3 The software or program code required for the functions of each module / unit in the system may be partially or completely stored in the memory 404. The processor 402 executes the program code corresponding to each unit stored in the memory 404 to perform the aforementioned security detection method.

[0145] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned safety detection method applied to the safety detection device 30.

[0146] The embodiment of the present application further provides a computer program product, which includes one or more computer instructions. When the computer instructions are loaded and executed on a computing device, the process or function described in the embodiment of the present application is generated in whole or in part.

[0147] The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from one website, computer or data center to another website, computer or data center via wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means.

[0148] When the computer program product is executed by a computer, the computer executes any of the aforementioned security detection methods. The computer program product may be a software installation package, and when any of the aforementioned security detection methods is needed, the computer program product may be downloaded and executed on a computer.

[0149] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to each embodiment of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0150] The units involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the unit / module does not, in some cases, constitute a limitation on the unit itself.

[0151] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0152] In the context of the present application embodiment, machine-readable medium can be a tangible medium that can contain or store a program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include but is not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0153] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0154] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0155] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0156] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0157] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A safety detection method, characterized in that: The method comprises: In response to detecting a target file event of a first computing device, obtaining a first code file related to the target file event; wherein the first code file is used to be executed in the first computing device; Generate a first prompt word; The first prompt word includes: the first code file; information indicating detection of the following target data: external input in the first code file, target execution function in the first code file, and transmission path of the external input in the first code file; and information indicating detection method of detecting the first code file based on the target data; The first prompt word is sent to a first language model, and a detection result of the first code file returned by the first language model is received.

2. The method according to claim 1, characterized in that The detection method of detecting the first code file based on the target data includes: In response to satisfying the following conditions, it is determined that the first code file has failed detection: there are external inputs and target execution functions in the first code file, and based on a transmission path of the external input in the first code file, it is determined that an input parameter of the target execution function is derived from the external input.

3. The method according to claim 1, characterized in that The information indicating detection of a transmission path of the external input in the first code file includes: Information indicating detection of a propagation path of the external input after passing through at least one of the following operations in the first code file: an assignment operation, an encoding operation, a decoding operation, an encryption operation, and a conversion operation.

4. The method according to claim 1, characterized in that: The method further comprises: Acquire auxiliary information representing natural language content from a security detection knowledge base; wherein the auxiliary information includes: information describing external input in a code file, information describing a determined propagation path, and information describing an input target execution function in a code file; The first prompt word also includes: the auxiliary information.

5. The method according to claim 1, characterized in that The method further comprises: Perform at least one of the following operations on the first code file: match the first code file with a file set and determine the file size of the first code file; wherein the file set includes a plurality of files; The step of generating the first prompt word comprises: In response to at least one of the following situations, a first prompt word is generated: the first code file is not successfully matched with the file set and the file size of the first code file is smaller than a set threshold.

6. The method according to claim 1, characterized in that The detection result of the first code file includes at least one of the following: information indicating whether the first code file passes the detection, information describing the analysis process of generating the detection result, and a code snippet in the first code file related to the detection result.

7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: In response to the detection result indicating that the first code file fails the detection, generating an alarm event according to the detection result; Present information associated with the alarm event.

8. The method according to claim 7, characterized in that The method further comprises: Receiving a determination operation for the alarm event; In response to the determination operation indicating that the information associated with the alarm event is erroneous, at least one of the following operations is performed: updating the information associated with the alarm event, updating a security detection knowledge base, and adding the first code file to a file set.

9. A safety detection device, characterized in that: The device comprises: an acquisition module, configured to acquire, in response to detecting a target file event of a first computing device, a first code file related to the target file event; wherein the first code file is used to be executed in the first computing device; A generating module, configured to generate a first prompt word; wherein the first prompt word includes: the first code file; information indicating detection of the following target data: an external input in the first code file, a target execution function in the first code file, and a transmission path of the external input in the first code file; and information indicating a detection method for detecting the first code file based on the target data; The communication module is used to send the first prompt word to the first language model and receive the detection result of the first code file returned by the first language model.

10. An electronic device, characterized in that: The electronic device comprises a processor and a memory; The processor is configured to execute instructions stored in the memory, so that the electronic device performs the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that: The method comprises instructions, wherein the instructions instruct an electronic device to execute the method according to any one of claims 1 to 8.

12. A computer program product, characterized in that The computer program product comprises computer readable instructions for implementing the method according to any one of claims 1 to 8.

Images