Webshell security detection analysis method and system based on semantic analysis engine

Abstract

The invention discloses a webshell security detection analysis method and system based on a semantic analysis engine, and relates to the technical field of security detection.The webshell security detection analysis method comprises the steps that lexical analysis and grammatical analysis are conducted on a to-be-detected file, the file is converted into a language fragment, and an abstract syntax tree is constructed; extracting the stain subtree, identifying and marking the part containing the potential danger node, and evaluating the risk level of the potential danger node; malicious code behavior characteristics are extracted, and a standard definition BNF is used to construct a characteristic graph; and matching the potential danger nodes with the constructed feature graph, calculating a matching value to evaluate the risk of each potential danger node, and outputting the specific risk value of the node. According to the webshell security detection analysis method based on the semantic analysis engine provided by the invention, the limitation of a traditional detection method is effectively solved. According to the method, potential malicious code behaviors can be accurately identified, and the risk level of each node can be dynamically evaluated, so that more accurate security detection is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of security detection, and in particular to a webshell security detection and analysis method and system based on a semantic analysis engine. Background Art

[0002] With the development of Web technology, Webshell attacks have become a major hidden danger in the field of network security. This type of attack exploits vulnerabilities in Web applications, allowing attackers to execute arbitrary code on infected servers, and then conduct malicious activities such as data theft and system damage. Existing Webshell detection methods mostly rely on feature matching and simple signature scanning, but these methods often show shortcomings in the face of ever-changing attack methods, especially for obfuscated or encrypted malicious code. In addition, static analysis methods may have recognition errors in complex code structures, and dynamic analysis is difficult to monitor in real time due to its environmental dependence and performance overhead limitations. Therefore, there is an urgent need for a more effective detection mechanism that can deeply understand the semantics and structure of the code to improve detection accuracy. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the existing Webshell detection method has the problems of insufficient accuracy and poor adaptability to new attack methods, and the technical problem of how to optimize Webshell security detection through deep semantic analysis.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a webshell security detection and analysis method based on a semantic analysis engine, comprising:

[0006] Perform lexical analysis and syntax analysis on the file to be tested, convert the file into language fragment Tokens and build an abstract syntax tree AST;

[0007] Extract tainted subtrees from AST, identify and mark the parts containing potentially dangerous nodes, and assess the risk level of potentially dangerous nodes;

[0008] Extract malicious code behavior features and construct feature graphs using standard definition BNF;

[0009] The potential dangerous nodes are matched with the constructed feature graph, the matching value is calculated to evaluate the risk of each potential dangerous node, and the specific risk value of the node is output.

[0010] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, wherein: the lexical analysis and syntax analysis include reading the content of the file to be detected, loading the file content into the memory, and specifying the encoding format of the file;

[0011] Initialize the lexical analyzer and configure it to the standard grammar rules of the target programming language;

[0012] Performing lexical analysis to decompose the file content into language segments, wherein the language segments include keywords, operators, and identifiers;

[0013] Use the syntax analyzer to analyze Tokens and build an abstract syntax tree;

[0014] Traverse the AST, verify that the structure conforms to the predefined grammatical rules, and record exceptions or errors during the parsing process.

[0015] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, wherein: the part of the potential dangerous node includes traversing AST and identifying the tainted source node, and the tainted source node includes user input, HTTP request parameters and external data sources;

[0016] Starting from each taint source node, extract the taint subtree downward, record the related nodes and their parent-child relationships, and form a taint propagation path;

[0017] A risk level assessment is performed on each node in the extracted taint subtree, considering the node’s type, context, and potential impact.

[0018] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, the risk level assessment includes traversing the abstract syntax tree, identifying the type of each node, and if the node is a database operation or system command execution, it is marked as high risk; if the node involves user input and is verified, it is marked as medium risk; other routine operations are marked as low risk.

[0019] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, wherein: for medium-risk nodes, the conditional structure is analyzed, and if the condition affects the execution of the node, the risk level is adjusted to high risk;

[0020] If the node is in a loop, analyze the number of iterations and input changes. If the input changes lead to data leakage or tampering, adjust the risk level to high risk;

[0021] For low-risk nodes, check their context and potential impacts. If any medium-risk factors are found, adjust the risk level to medium risk;

[0022] Combined with the node's taint propagation path, if the path causes system security issues, the node's risk level will be raised to high risk.

[0023] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, wherein: the use of the standard definition BNF to construct a feature graph includes collecting known malicious code samples, analyzing known behavioral characteristics and attack patterns;

[0024] Use the standard definition BNF to build feature graphs to describe various malicious behavior characteristics, including code structure, function calls, and data flows;

[0025] The feature maps are stored in a feature library, assigning a unique identifier to each feature.

[0026] As a preferred solution of the webshell security detection and analysis method based on the semantic analysis engine described in the present invention, wherein: the matching includes traversing the extracted taint subtree, matching each potential danger node with the feature graph one by one;

[0027] Calculate the similarity between each potential dangerous node and the feature graph for analysis;

[0028] Based on the matching results, the risk level of the node is dynamically adjusted.

[0029] Another object of the present invention is to provide a webshell security detection and analysis system based on a semantic analysis engine, which can solve the problems of recognition errors and insufficient real-time monitoring capabilities in existing static and dynamic detection methods by constructing a webshell security detection and analysis system based on a semantic analysis engine.

[0030] To solve the above technical problems, the present invention provides the following technical solutions: a webshell security detection and analysis system based on a semantic analysis engine, comprising: a preprocessing module, a taint subtree processing module, a feature graph construction module and a semantic analysis module;

[0031] The preprocessing module is used to perform lexical analysis and grammatical analysis on the file to be detected, convert the file into language fragment Tokens and construct an abstract syntax tree AST;

[0032] The tainted subtree processing module is used to extract the tainted subtree from the AST, identify and mark the part containing the potentially dangerous node, and evaluate the risk level of the potentially dangerous node;

[0033] The feature graph construction module is used to extract malicious code behavior features and construct a feature graph using the standard definition BNF;

[0034] The semantic analysis module is used to match the potential dangerous nodes with the constructed feature graph, calculate the matching value to evaluate the risk of each potential dangerous node, and output the specific risk value of the node.

[0035] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the webshell security detection and analysis method based on a semantic analysis engine as described above are implemented.

[0036] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the webshell security detection and analysis method based on a semantic analysis engine as described above.

[0037] Beneficial effects of the present invention: The webshell security detection and analysis method based on the semantic analysis engine provided by the present invention effectively makes up for the shortcomings of traditional Webshell detection methods in the face of complex attack methods such as obfuscation and encryption by introducing a semantic analysis engine and combining it with deep dynamic analysis of the taint propagation path. Compared with feature matching and static analysis methods, the present invention not only constructs a multidimensional feature graph based on the BNF standard definition, but also incorporates a dynamic fuzzy matching mechanism, so that the system can still accurately identify potential malicious behaviors when the code structure is modified. In addition, through the real-time dynamic adjustment mechanism of the risk level, the system can accurately locate high-risk nodes and improve the accuracy and precision of detection according to the context and the taint propagation path. This solution greatly reduces the missed alarm rate and false alarm rate, enhances the adaptability to multi-stage attacks, and takes into account the balance between performance and accuracy, greatly improving the overall protection effect of Webshell security detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0039] Figure 1 An overall flow chart of a webshell security detection and analysis method based on a semantic analysis engine provided by an embodiment of the present invention.

[0040] Figure 2 An overall structural diagram of a webshell security detection and analysis system based on a semantic analysis engine provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0042] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0043] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a webshell security detection and analysis method based on a semantic analysis engine, including:

[0044] Perform lexical analysis and syntax analysis on the file to be tested, convert the file into language fragment Tokens and build an abstract syntax tree AST;

[0045] Extract tainted subtrees from AST, identify and mark the parts containing potentially dangerous nodes, and assess the risk level of potentially dangerous nodes;

[0046] Extract malicious code behavior features and construct feature graphs using standard definition BNF;

[0047] The potential dangerous nodes are matched with the constructed feature graph, the matching value is calculated to evaluate the risk of each potential dangerous node, and the specific risk value of the node is output.

[0048] Performing lexical analysis and syntax analysis includes reading the content of the file to be tested, loading the file content into memory, and specifying the encoding format of the file;

[0049] Initialize the lexical analyzer and configure it to the standard grammar rules of the target programming language;

[0050] Perform lexical analysis to break down the file content into language fragments, including keywords, operators, and identifiers;

[0051] Use the syntax analyzer to analyze Tokens and build an abstract syntax tree;

[0052] Traverse the AST, verify that the structure conforms to the predefined grammatical rules, and record exceptions or errors during the parsing process.

[0053] The part of potentially dangerous nodes includes traversing the AST and identifying tainted source nodes, which include user input, HTTP request parameters, and external data sources;

[0054] Starting from each taint source node, extract the taint subtree downward, record the related nodes and their parent-child relationships, and form a taint propagation path;

[0055] A risk level assessment is performed on each node in the extracted taint subtree, considering the node’s type, context, and potential impact.

[0056] Risk level assessment includes traversing the abstract syntax tree and identifying the type of each node. If the node is a database operation or system command execution, it is marked as high risk; if the node involves user input and is verified, it is marked as medium risk; other routine operations are marked as low risk.

[0057] For medium-risk nodes, analyze the conditional structure and adjust the risk level to high risk if the condition affects the node execution;

[0058] If the node is in a loop, analyze the number of iterations and input changes. If the input changes lead to data leakage or tampering, adjust the risk level to high risk;

[0059] For low-risk nodes, check their context and potential impacts. If any medium-risk factors are found, adjust the risk level to medium risk;

[0060] Combined with the node's taint propagation path, if the path causes system security issues, the node's risk level will be raised to high risk.

[0061] Using the standard definition BNF to build a feature graph includes collecting known malicious code samples and analyzing known behavioral characteristics and attack patterns;

[0062] Use the standard definition BNF to build feature graphs to describe various malicious behavior characteristics, including code structure, function calls, and data flows;

[0063] The feature graph is stored in the feature library, and each feature is assigned a unique identifier. The feature library is updated regularly to add newly discovered malicious code behavior features to maintain detection accuracy.

[0064] Performing the matching includes traversing the extracted taint subtree and matching each potentially dangerous node with the feature graph one by one;

[0065] Calculate the similarity between each potential dangerous node and the feature graph for analysis;

[0066] Based on the matching results, the risk level of the node is dynamically adjusted.

[0067] Example 2

[0068] Reference Figure 2 , is an embodiment of the present invention, and provides a webshell security detection and analysis system based on a semantic analysis engine, including:

[0069] Preprocessing module 100, taint subtree processing module 200, feature map construction module 300 and semantic analysis module 400;

[0070] The preprocessing module 100 is used to perform lexical analysis and grammatical analysis on the file to be detected, convert the file into language fragment Tokens and construct an abstract syntax tree AST;

[0071] The tainted subtree processing module 200 is used to extract the tainted subtree from the AST, identify and mark the part containing the potential dangerous node, and evaluate the risk level of the potential dangerous node;

[0072] The feature graph construction module 300 is used to extract malicious code behavior features and construct a feature graph using the standard definition BNF;

[0073] The semantic analysis module 400 is used to match the potential dangerous nodes with the constructed feature graph, calculate the matching value to evaluate the risk of each potential dangerous node, and output the specific risk value of the node.

[0074] Embodiment 3, an embodiment of the present invention, is different from the first two embodiments in that:

[0075] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0076] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0077] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0078] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0079] Example 4 is an embodiment of the present invention, which provides a webshell security detection and analysis method based on a semantic analysis engine. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.

[0080] The purpose of the experiment is to perform Webshell detection on different types of files (including malicious files such as Dama and one-sentence Trojans in PHP files) through a semantic analysis-based method to verify the effectiveness of the system.

[0081] Sample set: The experiment tested various types of files, 100 of each type. These files include: normal PHP files, Trojans (PHP files), Trojans (PHP files) and deformed files (other files such as pictures, certificates, etc.).

[0082] The experiment extracts the tainted subtree (i.e., the part related to malicious behavior) of the file through semantic analysis and calculates the proportion of the tainted subtree.

[0083] The experimental results are shown in Table 1, Table 2, Table 3 and Table 4. Through the method of the present invention, the accuracy, precision and performance of the system in detecting various types of Webshell files are verified. Compared with the existing experiments, the new experiments will pay more attention to the precision of the taint propagation path and contextual risk assessment, improve the detection ability of complex attack patterns, and reduce missed reports and false positives.

[0084] Table 1 Taint subtree extraction and risk level assessment table for different file types

[0085]

[0086] Table 2 Comparison of test results of different detection tools

[0087]

[0088]

[0089] Table 3. Characteristic graph matching results and risk adjustment table

[0090]

[0091]

[0092] Table 4 System overall performance evaluation and dynamic adjustment impact table

[0093] index Before adjustment After adjustment Detection accuracy 94％ 98％ False Positive Rate 5％ 2％ False negative rate 6％ 1％ Average processing time / file 0.04 seconds 0.03 seconds Dynamic adjustment times N / A 24 times

[0094] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A webshell security detection and analysis method based on a semantic analysis engine, characterized in that: include: Perform lexical analysis and syntax analysis on the file to be tested, convert the file into language fragment Tokens and build an abstract syntax tree AST; Extract tainted subtrees from AST, identify and mark the parts containing potentially dangerous nodes, and assess the risk level of potentially dangerous nodes; Extract malicious code behavior features and construct feature graphs using standard definition BNF; The potential dangerous nodes are matched with the constructed feature graph, the matching value is calculated to evaluate the risk of each potential dangerous node, and the specific risk value of the node is output.

2. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 1 is characterized in that: The lexical analysis and syntax analysis include reading the content of the file to be detected, loading the content of the file into the memory, and specifying the encoding format of the file; Initialize the lexical analyzer and configure it to the standard grammar rules of the target programming language; Performing lexical analysis to decompose the file content into language segments, wherein the language segments include keywords, operators, and identifiers; Use the syntax analyzer to analyze Tokens and build an abstract syntax tree; Traverse the AST, verify that the structure conforms to the predefined grammatical rules, and record exceptions or errors during the parsing process.

3. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 2 is characterized in that: The portion of the potentially dangerous nodes includes traversing the AST and identifying tainted source nodes, wherein the tainted source nodes include user input, HTTP request parameters, and external data sources; Starting from each taint source node, extract the taint subtree downward, record the related nodes and their parent-child relationships, and form a taint propagation path; A risk level assessment is performed on each node in the extracted taint subtree, considering the node’s type, context, and potential impact.

4. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 3 is characterized in that: The risk level assessment includes traversing the abstract syntax tree, identifying the type of each node, and marking it as high risk if the node is a database operation or system command execution; if the node involves user input and is verified, it is marked as medium risk; Other routine operations are marked as low risk.

5. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 4 is characterized in that: For medium-risk nodes, analyze the conditional structure and adjust the risk level to high risk if the condition affects the node execution; If the node is in a loop, analyze the number of iterations and input changes. If the input changes lead to data leakage or tampering, adjust the risk level to high risk; For low-risk nodes, check their context and potential impacts. If any medium-risk factors are found, adjust the risk level to medium risk; Combined with the node's taint propagation path, if the path causes system security issues, the node's risk level will be raised to high risk.

6. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 5 is characterized in that: The use of the standard definition BNF to construct a feature graph includes collecting known malicious code samples and analyzing known behavior characteristics and attack patterns; Use the standard definition BNF to build feature graphs to describe various malicious behavior characteristics, including code structure, function calls, and data flows; The feature maps are stored in a feature library, assigning a unique identifier to each feature.

7. The webshell security detection and analysis method based on the semantic analysis engine as described in claim 6 is characterized in that: The matching includes traversing the extracted taint subtree and matching each potential dangerous node with the feature graph one by one; Calculate the similarity between each potential dangerous node and the feature graph for analysis; Based on the matching results, the risk level of the node is dynamically adjusted.

8. A system using the webshell security detection and analysis method based on a semantic analysis engine as described in any one of claims 1 to 7, characterized in that: include: A preprocessing module (100), a taint subtree processing module (200), a feature map construction module (300) and a semantic analysis module (400); The preprocessing module (100) is used to perform lexical analysis and grammatical analysis on the file to be detected, convert the file into language fragment Tokens and construct an abstract syntax tree AST; The tainted subtree processing module (200) is used to extract the tainted subtree from the AST, identify and mark the part containing the potential dangerous node, and evaluate the risk level of the potential dangerous node; The feature graph construction module (300) is used to extract malicious code behavior features and construct a feature graph using a standard definition BNF; The semantic analysis module (400) is used to match the potential dangerous nodes with the constructed feature graph, calculate the matching value to evaluate the risk of each potential dangerous node, and output the specific risk value of the node.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the webshell security detection and analysis method based on a semantic analysis engine described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the webshell security detection and analysis method based on a semantic analysis engine described in any one of claims 1 to 7 are implemented.

Images