Method and device for restoring and compressing PowerShell code and electronic equipment

Abstract

The invention provides a PowerShell code restoration and compression method and device and electronic equipment, and belongs to the technical field of network security, the method can restore a to-be-detected PowerShell code, and can obtain a compressed threat information chain code corresponding to a restored to-be-detected PowerShell source code, and the threat information chain code can be used for detecting the to-be-detected PowerShell code according to the reduced to-be-detected PowerShell code. In this way, the big model can accurately detect the regular and compressed threat information chain code, that is, the method can restore the obfuscated PowerShell code, and compress the long restored PowerShell source code to be detected into the compressed threat information chain code. And the compressed threat information chain code is effectively detected by the large model.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method, device and electronic device for restoring and compressing PowerShell codes. Background Art

[0002] PowerShell is a powerful command line interface (CLI) and scripting language developed by Microsoft. It is designed for system administrators and developers to achieve system management and task automation. With PowerShell, users can perform various system management tasks, such as configuring system settings, managing users and permissions, and monitoring system performance.

[0003] However, the power of PowerShell can also be exploited by malicious users to create malicious scripts. These malicious scripts can perform unauthorized operations, such as stealing sensitive information, destroying system files, and spreading malware. Because PowerShell scripts can easily bypass certain security restrictions, they have become one of the commonly used tools in cyber attacks.

[0004] At present, there are three main PowerShell-based detection methods: the first is the traditional detection method based on fingerprints, feature libraries, blacklists, etc., which is limited by the lag of existing knowledge and is difficult to effectively detect new malicious codes; the second is to extract dynamic and static features of the code and use machine learning or deep learning models for training and identification, but the traditional method requires manual design of feature extractors, relies on the knowledge and experience of domain experts, and performs poorly when dealing with long-distance dependencies, especially when dealing with complex data such as text and code; the third is to use large models for malicious code detection (large models have a strong ability to understand context), and can well analyze and detect regular samples (samples refer to PowerShell scripts / PowerShell codes), but the effect is not good when facing obfuscated samples, and there are context restrictions (scripts that are too long cannot be entered), which is very resource-consuming for the detection of large samples.

[0005] In summary, how to effectively detect obfuscated scripts and large scripts has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a method, device and electronic device for restoring and compressing PowerShell code to alleviate the technical problem that the prior art cannot effectively detect obfuscated scripts and large scripts.

[0007] In a first aspect, an embodiment of the present invention provides a method for restoring and compressing PowerShell code, comprising: Restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; Generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, scopes of custom variables, custom variable call information, scopes of custom variable call information, custom functions, scopes of custom functions, custom function call information, and scopes of custom function call information; Determine the dangerous function information of each line of statement code according to the preset dangerous function rules; Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; In the call information backtracking library, the line number of the statement code with the dangerous function information is used as the starting line number to backtrack the threat information chain to obtain the compressed threat information chain line number; Merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result; The compressed threat information chain code is input into the large model so that the large model detects and analyzes the compressed threat information chain code.

[0008] In an embodiment of the present invention, a method for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain a restored PowerShell source code to be detected, and extracting code structure information of the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: a custom variable, a scope of the custom variable, custom variable call information, a scope of the custom variable call information, a custom function, a scope of the custom function, a custom function call information, and a scope of the custom function call information; extracting a threat based on a preset risk function; and extracting a threat based on a preset risk function. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with the dangerous function information as the starting line number to perform threat information chain backtracking to obtain a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model performs detection and analysis on the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code, that is, the method of the present invention can restore the obfuscated PowerShell code, and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0010] Figure 1 A flowchart of a PowerShell code restoration and compression method provided by an embodiment of the present invention; Figure 2 A schematic diagram of the code structure information of the PowerShell source code to be detected after restoration provided by an embodiment of the present invention; Figure 3 A flow chart of obtaining variable call line information of a custom variable in a variable definition line provided by an embodiment of the present invention; Figure 4 A schematic diagram of a PowerShell code restoration and compression device provided by an embodiment of the present invention; Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0011] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0012] Traditional technologies cannot effectively detect obfuscated scripts and large scripts.

[0013] Based on this, the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code, that is, the method of the present invention can restore the obfuscated PowerShell code, and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code.

[0014] To facilitate understanding of this embodiment, a PowerShell code restoration and compression method disclosed in an embodiment of the present invention is first introduced in detail.

[0015] Embodiment 1: According to an embodiment of the present invention, an embodiment of a method for restoring and compressing PowerShell code is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0016] Figure 1 is a flowchart of a PowerShell code restoration and compression method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps: Step S102, restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; Specifically, obfuscating and deforming PowerShell malicious scripts is the main means for hackers to bypass conventional malware detection methods, which will also result in the inability to extract effective threat information when extracting threat information from them. Therefore, restoring the obfuscated scripts is a necessary step. That is, it is necessary to restore the PowerShell code to be detected. The specific process of restoration will be described in detail below, so I will not go into details here.

[0017] After obtaining the restored PowerShell source code to be tested, the code structure information is extracted. The extracted code structure information will be used for subsequent processing steps. The extracted code structure information includes: information of various types of statements, including: assignment statement information, function definition information, class definition information, etc. The information of each type of statement includes rich detailed information. Taking the assignment statement information as an example, it includes: variable name, line number where the assignment statement is located, source of the variable (normal assignment, Param parameter, ${} assignment, Set-Variable, Set-Item, variable assignment in Foreach, and $global and $script, etc.). Figure 2 As shown, the code structure information of the restored PowerShell source code to be detected is shown.

[0018] Step S104, generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, custom variable scopes, custom variable call information, custom variable call information scopes, custom functions, custom function scopes, custom function call information, and custom function call information scopes; Step S106, determining the dangerous function information of each line of statement code according to a preset dangerous function rule; Step S108, processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; Step S110, in the call information backtracking library, using the line number of the statement code with the dangerous function information as the starting line number to backtrack the threat information chain, and obtaining the compressed threat information chain line number; Step S112, merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result; Step S114: input the compressed threat information chain code into the large model so that the large model detects and analyzes the compressed threat information chain code.

[0019] Specifically, if there are multiple compressed threat information chain codes, these compressed threat information chain codes are simultaneously detected and analyzed in parallel to improve detection efficiency.

[0020] In an embodiment of the present invention, a method for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain a restored PowerShell source code to be detected, and extracting code structure information of the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: a custom variable, a scope of the custom variable, custom variable call information, a scope of the custom variable call information, a custom function, a scope of the custom function, a custom function call information, and a scope of the custom function call information; extracting a threat based on a preset risk function; and extracting a threat based on a preset risk function. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with the dangerous function information as the starting line number to perform threat information chain backtracking to obtain a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model performs detection and analysis on the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code, that is, the method of the present invention can restore the obfuscated PowerShell code, and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts.

[0021] The above content briefly introduces the PowerShell code restoration and compression method of the present invention. The specific contents involved are described in detail below.

[0022] In an optional embodiment of the present invention, restoring the PowerShell code to be detected specifically includes the following steps: (1) Convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree, so as to obtain the processed abstract syntax tree; Specifically, the PowerShell code to be detected is converted into an abstract syntax tree, which is a tree-shaped data structure that represents the structure of the source code. It is used to parse the syntax of the code into a hierarchical format for easy analysis and processing.

[0023] Then, the generated abstract syntax tree is traversed in a loop. When the traversed subtree part can be calculated, for example, when the abstract syntax tree subtree corresponding to the statement code "{1}{0}" -f 'x','ie' is traversed, it is found that the string formatting statement code can be calculated to obtain the calculation result 'iex', and a string node is generated using the calculation result 'iex' to replace the original entire subtree. When there is no subtree in the abstract syntax tree that can be calculated, the loop traversal of the abstract syntax tree is exited to obtain the processed abstract syntax tree.

[0024] (2) Decompile the abstract syntax tree to obtain the restored PowerShell source code to be tested.

[0025] In an optional embodiment of the present invention, generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information specifically includes the following steps: (1) Determine the scope of each line of statement code based on the code structure information, and organize the scope through a tree structure to obtain a scope tree. Then, determine the scope tuple of each line of statement code based on the scope of each line of statement code and the scope tree. In the scope tree, the name of the node is the name of the function or class, the identifier is the scope, and the data information is the start and end rows of the scope. Specifically, before extracting custom variables and custom functions, first process the scope-related information, because only the variable name and scope of the custom variable can well identify a custom variable. The scope information is processed as follows: Traverse the code structure information, and each time you encounter a Class structure or a Function structure, add 1 to the scope of the corresponding statement code, and then get the scope of each line of statement code, where the initial value of the scope is 0.

[0026] When implementing, traverse the code structure information, and each time you encounter a Class structure or a Function structure, add 1 to the corresponding Scope_Id (scope), and its initial value is 0. You also need to organize the Scope_Id through a tree structure to handle nested functions. The Tag (name of the tree node) of the Scope_Tree (scope tree) node is the name of the Function or Class, the ID (identifier) ​​is the Scope_Id (scope), and the Data information is the start and end rows of the Scope_Id.

[0027] In addition, the path between the scope of each line of statement code and the scope of the root node of the scope tree is reversed as the scope tuple of the corresponding line of statement code. For example, the scope of the current statement code is 3, and the path between it and the scope of the root node of the scope tree is (3, 2, 1, 0). After reversing the path (3, 2, 1, 0), we get (0, 1, 2, 3), which is the scope tuple of the current statement code.

[0028] (2) extracting a custom variable from the first target field of the code structure information, and taking the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable; Specifically, the extraction of custom variable information includes two parts: extraction of custom variables and extraction of custom variable call information. These two parts are explained in turn below.

[0029] Custom variables are extracted from the Assign (i.e., the first target field) of the code structure information, including various types of custom variables: ordinary assignment, Param parameter, ${} assignment, Set-Variable, Set-Item, variable assignment in Foreach, and $global and $script assignments. After extraction, you need to add scope information to the custom variable, and use the last scope of the line scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable, and use @VD (VD stands for Variable Define) plus the scope to identify it, for example, $a@VD0, where the custom variable is $a and the corresponding scope is 0.

[0030] (3) Use Python's Re library to match the custom variable with the restored PowerShell source code to be detected line by line to obtain the custom variable call information, and determine the scope of the custom variable call information based on whether the custom variable called by the custom variable call information belongs to the variable inside the custom class; Specifically, the custom variable call information needs to be matched using Python's Re library. Use Python's Re library to match each line of the restored PowerShell source code to be detected with all the custom variables obtained from assign, and finally obtain the custom variable call information of each line. The scope information of the custom variable call information is divided into two processing methods according to whether the called custom variable belongs to a variable inside a custom class: if the custom variable belongs to an internal variable of a class, then find its scope (that is, the scope of the statement code of the custom class) in the previous Scope_Tree according to the information of the class, and use it as the scope of the custom variable call information; if it is just ordinary custom variable call information, then the largest scope in the scope tuple of the statement code of the custom variable call information is used as the scope of the custom variable call information. For example, the custom variable call information is identified as "@V" plus the scope, such as $a@V0, where $a means that the called custom variable is $a, and the corresponding scope is 0. That is, if the custom variable belongs to a variable inside a custom class, the scope of the statement code of the custom class will be used as the scope of the custom variable calling information; if the custom variable does not belong to a variable inside a custom class, the largest scope in the scope tuple of the custom variable calling information will be used as the scope of the custom variable calling information.

[0031] (4) extracting the custom function from the second target field of the code structure information, and taking the second to last scope in the scope tuple of the statement code corresponding to the custom function as the scope of the custom function; Specifically, the extraction of user-defined function information also includes two parts: extraction of user-defined functions and extraction of user-defined function call information. These two parts are explained in turn below.

[0032] The custom function is extracted from the Class and Function of the code structure information. Then, the custom function name and "@FD" (FD stands for Function Define) plus the second-to-last scope of the scope tuple of the statement code line are used as the scope of the custom function, for example, LoadLibrary@FD1, where the custom function is LoadLibrary and the corresponding scope is 1.

[0033] In Powershell, when extracting a custom function, not only should the custom function of that line be extracted and identified, but the custom function identification of that line should also be added to the line where the param parameter of that function exists, so that subsequent function calls can be traced back to the complete function definition.

[0034] (5) Use Python's Re library to match the custom function with the restored PowerShell source code to be detected line by line to obtain the custom function call information, and determine the scope of the custom function call information based on whether the custom function called by the custom function call information belongs to the function inside the custom class.

[0035] Specifically, the custom function call information is also matched using Python's Re library (similar to the process of determining the custom variable call information). The scope of the custom function call information is handled in the same way as the scope of the custom variable call information. Then "@F" plus the scope is used as the custom function call identifier, for example, LoadLibrary@F1, where LoadLibrary indicates that the custom function called is LoadLibrary, and the corresponding scope is 1.

[0036] It should be noted that the code block structure information to which each line of statement code belongs needs to be determined based on the restored PowerShell source code to be detected.

[0037] Specifically, in order to keep the code structure intact after threat extraction, it is necessary to add the line number of each line of structure information to the line number of the line as Structure_List (that is, the code block structure information to which the line of statement code belongs). If you want to extract a line of statement code later, you should extract all the lines of statement code in the Structure_List information of that line. For ease of understanding, the sample code is given as follows. The line number of the structure information of the Function is [1,2,5], that is, lines 1, 2, and 5 are complete structure information lines. Therefore, the Structure_List of lines 1, 2, and 5 is [1,2,5], the Structure_List of line 3 is [1,2,3,5], and the fourth line is [1,2,4,5].

[0038] 1, function LoadLibrary 2, { 3, $dll = [System.Reflection.Assembly]::LoadFile($dllPath) 4, return $dll 5,} In an optional embodiment of the present invention, determining the dangerous function information of each line of statement code according to a preset dangerous function rule specifically includes the following steps: The corresponding dangerous function rules are matched with the code structure information in order from high to low dangerous levels, and when the matched dangerous function information reaches a preset number, the dangerous function rules of lower dangerous levels will no longer be matched, thereby obtaining the dangerous function information of each line of statement code.

[0039] Specifically, dangerous functions are matched for each line of code. The dangerous function rules to be matched include: dangerous Cmdlet commands, dangerous NativeCommands, and IL dangerous functions; dangerous functions include: single-rule dangerous functions and multi-rule dangerous functions: single-rule dangerous functions such as Set-ItemProperty, Out-File, and Cscript.exe can be classified as dangerous functions; while multi-rule dangerous functions are defined as dangerous functions only when multiple functions appear at the same time. For example, {"Class": "Convert", "Function": "FromBase64String"} and {"Class": "Reflection.Assembly", "Function": "Load"} appear at the same time to be defined as dangerous functions. Dangerous functions include different danger levels. In order to extract enough threat information from the code while making the extracted information small enough, dangerous function rules should be matched from high danger level to low danger level (in order to improve the compression rate while minimizing the loss of threat information, dangerous functions with high danger levels are extracted first). Once the matched dangerous function information reaches the preset number, the low-level dangerous function rules will no longer be matched. During the processing, the matched single-rule hazard function information and multi-rule hazard function information should be stored separately. This is because in the subsequent threat information extraction stage, the multi-rule hazard function needs to trace back the multiple rows it is in together to generate the same compressed threat information chain line number; while the single-rule hazard function only needs to trace back a single row.

[0040] Custom variables are restricted according to selection conditions such as If-Else, Try-Catch, and Switch to ensure that within the same scope, even if there are multiple assignments and calls of custom variables with the same name, the custom variables called by the custom variable call information can still be accurately traced back. In an optional embodiment of the present invention, the selection conditions in the restored PowerShell source code to be detected are processed into a tree structure, and the obtained selection condition tree is used to determine the variable call line information of the custom variables in each variable definition line in the basic information and the function call line information of the custom functions in each function definition line in the basic information, and then the call information backtracking library is obtained, which specifically includes the following steps: (1) Determine the variable definition line list based on the custom variable, and determine the variable call line list based on the custom variable call information; Specifically, generate Variable_define_dict (i.e. variable definition dictionary) and Variable_call_dict (i.e. variable call dictionary). Variable_define_dict stores the information about variable definition: the key is the custom variable, and the value is all the rows where the custom variable appears; Variable_call_dict stores the information about variable call: the key is the custom variable call information, and the value is all the rows where the custom variable call information appears.

[0041] (2) Determine the selection condition domain of each line of statement code according to the code structure information, and organize the selection condition domain through a tree structure to obtain a selection condition tree, where the name of the node in the selection condition tree is the selection condition domain of the corresponding statement code, and the data information is the starting row and the ending row of the selection condition domain; Specifically, the selection condition domain (i.e., Associated_id) starts at 0 and increases by 1 each time a new selection condition is encountered, and the same selection condition shares the same Associated_id. When constructing the selection condition tree, the Tag and ID of the root node are set to 0. Each time a new selection condition node is added, the ID (node ​​identifier) ​​is incremented, and the Tag (i.e., name) is set to the selection condition domain value of the corresponding statement code. In addition, each node of the tree contains Data information: Start_line and End_line.

[0042] (3) Traverse the variable definition line list and copy the variable definition line list and variable call line list each time; Specifically, according to Figure 3 The steps shown traverse the list of variable definition lines. That is, traversing the keys and values ​​in Variable_define_dict, variable restrictions can be successfully implemented. The following is a detailed description of the algorithm combined with the sample code snippet: 1, $number = 3 2. $flag = Read-Host "Please enter a value (true / false)" 3. Write-Output "$number" 4, if ($flag -gt 3) { 5, $number = 7 6, if ($flag -gt 9) { 7, $number = 10 8. Write-Output "$number" 9,} 10, if ($flag -gt 12) { 11, $number = 21 12. Write-Output "$number" 13,} 14,} else { 15, $number = 9 16. Write-Output "$number" 17,} 18, $number = 17 19. Write-Output "$number" In the above code segment, the variable definition line list of custom variable $number is [1,5,7,11,15,18], where each number indicates that the statement code of the corresponding line is the variable definition line of custom variable $number. The statement code of line 1 defines the value of custom variable $number as 3. The variable call line list is [3,8,12,16,19], where each number indicates that the statement code of the corresponding line is the variable call line of custom variable $number. For example, the statement code of line 3 calls the custom variable $number.

[0043] Traverse the variable definition line list and copy the variable definition line list and variable call line list each time. All subsequent variable definition line lists and variable call line lists will use the copy.

[0044] (4) Split the variable call line list into a list of restricted variable call lines and a list of unrestricted variable call lines according to whether the scope corresponding to each variable call line in the variable call line list is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list; Specifically, if the scope corresponding to a variable call line in the variable call line list (that is, the scope of the custom variable call information of the variable call line) is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list (that is, the scope tuple of the statement code of the current variable definition line), then the variable call behavior can restrict the variable call line; if not equal, then the variable call behavior cannot restrict the variable call line.

[0045] (5) Delete the variable definition lines and variable call lines that are less than or equal to the current variable definition line in the variable definition line list and the restricted variable call line list, and sort the remaining variable definition lines in ascending order to obtain the first filtered variable definition line list and the first filtered variable call line list; Specifically, since the same custom variable is defined first and then called under the same scope, it is necessary to delete the variable definition lines and variable call lines in the variable definition line list and the restricted variable call line list that are less than or equal to the current variable definition line, and then sort the remaining variable definition lines from small to large to obtain the first filtered variable definition line list and the first filtered variable call line list, so that when a custom variable is closed later, all variable call lines after the selection condition to which the closed line belongs can be directly deleted, and then exit the loop to reduce the running time.

[0046] (6) Delete the variable definition lines and variable call lines of the user-defined variables with the same name as the current variable definition line and other than the branch to which the current variable definition line belongs from the first filtered variable definition line list and the first filtered variable call line list, and obtain the second filtered variable definition line list and the second filtered variable call line list; Specifically, in the first filtered variable definition line list and the first filtered variable call line list, delete the variable definition line and the variable call line of the same name custom variable that belongs to the same selection condition as the current variable definition line and is not in the branch to which the current variable definition line belongs. For example, if the 5th line of the custom variable $number is currently being traversed, 15 in the first filtered variable definition line list and 16 in the first filtered variable call line list should be deleted.

[0047] (7) Set the closed flag to false and traverse the list of variable definition lines after the second filter; Specifically, the initial value of the close flag Close_flag is set to False. Then, the variable definition line list after the second filtering is traversed.

[0048] (8) determining a relationship between the current second filtered variable definition row and the new second filtered variable definition row according to a selection condition path of the current second filtered variable definition row and a selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined according to a selection condition tree; Specifically, the new second filtered variable definition line traverses the second filtered variable definition lines in the second filtered variable definition line list.

[0049] The selection condition path of the current second filtered variable definition row is all the selection condition domains on the path from the current second filtered variable definition row to the root node in the selection condition tree, and the selection condition path of the new second filtered variable definition row is all the selection condition domains on the path from the new second filtered variable definition row to the root node in the selection condition tree.

[0050] The above relationships include: internal inclusion, external inclusion and parallel relationships.

[0051] a) Inclusion: When the selection condition path of the new second filtered variable definition line truly contains the selection condition path of the current second filtered variable definition line. Take the 5th and 7th lines of the custom variable $number as an example. The selection condition path of the 5th line is Path1 = {0,1}, and the selection condition path of the 7th line is Path2 = {0,1,2}. Path2 truly contains Path1, which is an inclusion relationship.

[0052] b) External inclusion: When the selection condition path of the current second filtered variable definition row contains the selection condition path of the new second filtered variable definition row. Take the 5th and 18th rows of variable $number as an example. The selection condition path of the 5th row is Path1 = {0,1}, and the selection condition path of the 18th row is Path2 = {0}. Path1 contains Path2, which is an external inclusion relationship.

[0053] c) Parallel: The specific calculation logic is to calculate the intersection between the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row. The intersection is required to be a true subset of the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row. Take the 7th and 11th rows of the custom variable $number as an example. The node path of the 7th row is Path1 = {0,1,2}, the node path of the 11th row is Path2 = {0,1,3}, the intersection Path3 = {0,1}, and Path3 is a true subset of Path1 and Path2. So it belongs to a parallel relationship.

[0054] (9) If the relationship is outer inclusion and the selection condition to which the current second filtered variable definition line belongs is closed, it is determined that the scope of the new second filtered variable definition line covers the scope of the current second filtered variable definition line, and all second filtered variable call lines after the selection condition closed line are deleted from the second filtered variable call line list, and the closed flag is set to true; Specifically, whether the custom variable is closed is determined based on the above relationship. Closure requires that the custom variable definition must be closed in the same selection condition. As shown in the above code segment, line 18 is the selection condition closing line of line 4, so line 19 can be deleted.

[0055] (10) If the relationship is inclusive / parallel, and the selection condition of the current second filtered variable definition row is closed, then recursively determine whether the selection condition of the new second filtered variable definition row is closed, and delete all second filtered variable call rows between the closed structure tail row of the selection condition of the current second filtered variable definition row and the closed structure tail row of the selection condition of the new second filtered variable definition row in the second filtered variable call row list until the recursive termination condition is satisfied, wherein the inclusive recursive termination condition is: reaching the selection condition domain of the current second filtered variable definition row; the parallel recursive termination condition is: reaching the maximum selection condition domain in the intersection of the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row; Specifically, recursively determine whether the selection condition to which the new second filtered variable definition line belongs is closed, that is, if the structure of the current selection condition is closed (for example, it is a complete if else structure, which is closed), then it is necessary to determine whether the upper-level selection condition structure is closed, and at the same time delete the variable call line number between the last line of the closed structure and the last line of the upper-level closed structure.

[0056] (11) If the selection condition corresponding to the recursive cutoff condition is closed, then delete all variable call lines after the last line of the closed structure of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs in the above-mentioned deleted variable call line list, and set the closed flag to true; (12) After the traversal of the variable definition line list after the second filter is completed or the closed flag is true, the variable call line list finally obtained and the unrestricted variable call line list are concatenated to obtain the variable call line information of the custom variable of the current variable definition line, until the traversal of all variable definition lines in the variable definition line list is completed, and the variable call line information of the custom variables of all variable definition lines is obtained; Specifically, define_call_dict is used to collect the variable call line information of the custom variable in the current variable definition line: its key is the line number, and its value is a new dictionary. The key of the new dictionary is a custom variable existing in the line, and the value is the line number set that the variable should backtrack to when backtracking (i.e., variable call line information). The following is an example of define_call_dict from line 1 to line 3: {1: {'$number@VD0': {3}}, 2: '$flag@VD0': {4, 6, 10}}, 3: {'$number@V0': {1}}}. In essence, it is the correspondence between the line number of the variable definition line, the custom variable, and the variable call line information.

[0057] (13) According to the user-defined function and the user-defined function calling information, the function calling line information of the user-defined function in all function definition lines is obtained, and the variable calling line information of the user-defined variables in all variable definition lines and the function calling line information of the user-defined function in all function definition lines are used as a calling information backtracking library.

[0058] Specifically, since Define_call_dict only contains custom variables and their corresponding variable call row information, the custom functions and custom function call information that have been matched by row should be added to Define_call_dict in the format. Of course, custom functions do not need to be restricted by variables.

[0059] In an optional embodiment of the present invention, the line number of the statement code with the dangerous function information is used as the starting line number to trace back the threat information chain to obtain the compressed threat information chain line number, which specifically includes the following steps: (1) Taking the line number of the statement code with dangerous function information as the starting line number, start backtracking in the call information backtracking library, obtain the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and save the target custom variable and / or target custom function and the new line number in the first dictionary, and save the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary, wherein when saving the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary, determine whether the token sum of the line number already saved in the second dictionary exceeds the predefined length, if so, merge the line numbers of the second dictionary and output; Specifically, if it is a multi-rule hazard function, there are multiple starting rows.

[0060] (2) Determine a new line to be backtraced, a new custom variable and / or a new custom function in the call information backtracing library according to the first dictionary, delete the source custom variable or source custom function of the target custom variable and / or the target custom function from the new line to be backtraced, the new custom variable and / or the new custom function, and delete the information in the second dictionary from the new line to be backtraced, the new custom variable and / or the new custom function, to obtain a target new line to be backtraced, and then use the target new line to be backtraced as the starting line number, return to execute the step of starting backtracing in the call information backtracing library, until there is no target line to be backtraced, or the sum of the tokens of all line numbers in the second dictionary obtained by backtracing exceeds a predefined length, and then obtain the compressed threat information chain line number according to the line number that has been backtraced, wherein the number of compressed threat information chain line numbers is equal to the number of statement codes with dangerous function information.

[0061] Specifically, the new line number saved in the first dictionary is used as the new line to be backtraced, the target custom variable and / or target custom function saved in the first dictionary is used as the new custom variable and / or new custom function, and the source custom variable or source custom function of the target custom variable and / or target custom function is deleted from the new line to be backtraced, the new custom variable and / or the new custom function, in order to avoid an infinite loop. For example, if it comes from $results@VD0, the new line to be backtraced must contain $results@V0, so this key-value pair ($results@V0) needs to be filtered out. And the information in the second dictionary is deleted from the new line to be backtraced, the new custom variable and / or the new custom function, because it has been backtraced and does not need to be backtraced again, which shortens the running time of the threat extraction algorithm. The deleted new line to be backtraced is the target new line to be backtraced.

[0062] For example, the row numbers of the compressed threat information chain are [1,3,7,8].

[0063] It should be noted that if you are tracing back the function definition line from a function call, you need to trace back the param associated with the function definition, that is, trace back all the lines containing the function definition (the function definition has been added to the line where the param exists).

[0064] If the param definition line is traced back from a param call, only the function definition needs to be traced back, and no other params need to be traced back.

[0065] In an optional embodiment of the present invention, the compressed threat information chain line numbers are merged, and the compressed threat information chain code is obtained according to the corresponding relationship between the line number and the statement code in the merged result, which specifically includes the following steps: (1) Determine the token length corresponding to each row in the compressed threat information chain row number, and calculate the total number of tokens for each compressed threat information chain row number based on the token length corresponding to each row in the compressed threat information chain row number; Specifically, in order to reduce the number of scripts obtained by the threat extraction operation, the scripts are merged according to the number of overlapping tokens between the scripts, thereby obtaining fewer scripts.

[0066] In implementation, if the length of the token corresponding to the first row of the compressed threat information chain row number [1,3,7,8] is 2, the length of the token corresponding to the third row is 6, the length of the token corresponding to the seventh row is 14, and the length of the token corresponding to the eighth row is 10, then the total number of tokens in the compressed threat information chain row number [1,3,7,8] = 2+6+14+10=32.

[0067] (2) Determine the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number according to the total number of tokens in each compressed threat information chain row number; (3) Calculate the number of intersection tokens between the row numbers of other compressed threat information chains and the row numbers of the target compressed threat information chain, and sort the row numbers of other compressed threat information chains in descending order of the number of intersection tokens; Specifically, the other compressed threat information chain row numbers are other compressed threat information chain row numbers except the target compressed threat information chain row number among all compressed threat information chain row numbers. If the row number of another compressed threat information chain is [1, 3, 7, 9, 10] and the row number of the target compressed threat information chain is [1, 3, 7, 9, 15], the intersection of the two is [1, 3, 7, 9], and then the number of tokens of [1, 3, 7, 9] is calculated, that is, the total number of tokens in the 1st row, the 3rd row, the 7th row and the 9th row.

[0068] (4) determining in sequence whether the union of the current compressed threat information chain row number and the target compressed threat information chain row number in the sorted sequence exceeds a predefined length; (5) If it does not exceed, then the current compressed threat information chain row number and the target compressed threat information chain row number are taken as the union, and the current compressed threat information chain row number is deleted from the other compressed threat information chain row numbers, and the threat information chain row number after the union is taken is used as the compressed threat information chain row number, and the step of determining the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number is returned to execute, until the merger cannot be performed, and the merged threat information chain row number is obtained; Specifically, if it exceeds the limit, no processing will be performed.

[0069] (6) Convert each merged threat information chain line number according to the correspondence between the line number and the statement code to obtain a compressed threat information chain code.

[0070] The PowerShell code restoration and compression method of the present invention effectively solves the limitations of large models in analyzing and detecting obfuscated samples by introducing PowerShell script deobfuscation technology. At the same time, through the innovative threat information extraction algorithm, large samples are efficiently compressed to ensure that the size of the samples is significantly reduced without losing threat information. This improvement enables large models to process large samples more efficiently, improving the accuracy and efficiency of detection.

[0071] Embodiment 2: The embodiment of the present invention further provides a PowerShell code restoration and compression device, which is mainly used to execute the PowerShell code restoration and compression method provided in the first embodiment of the present invention. The PowerShell code restoration and compression device provided in the embodiment of the present invention is specifically introduced below.

[0072] Figure 4 is a schematic diagram of a PowerShell code restoration and compression device according to an embodiment of the present invention, such as Figure 4 As shown, the device mainly includes: a restoration and code structure information extraction unit 10, a generation unit 20, a first determination unit 30, a second determination unit 40, a backtracking unit 50, a merging unit 60, and an input unit 70, wherein: The restoration and code structure information extraction unit is used to restore the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extract the code structure information of the restored PowerShell source code to be detected to obtain the code structure information of the restored PowerShell source code to be detected; A generating unit, used to generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: a custom variable, a scope of the custom variable, custom variable call information, a scope of the custom variable call information, a custom function, a scope of the custom function, custom function call information, and a scope of the custom function call information; A first determining unit, configured to determine the dangerous function information of each line of statement code according to a preset dangerous function rule; The second determination unit is used to process the selection conditions in the restored PowerShell source code to be detected into a tree structure, and use the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; A backtracking unit is used to use the line number of the statement code with dangerous function information as the starting line number to backtrack the threat information chain in the call information backtracking library to obtain the compressed threat information chain line number; A merging unit, used to merge the compressed threat information chain line numbers, and obtain the compressed threat information chain code according to the corresponding relationship between the line number and the statement code in the merging result; The input unit is used to input the compressed threat information chain code into the large model so that the large model can detect and analyze the compressed threat information chain code.

[0073] In an embodiment of the present invention, a device for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain a restored PowerShell source code to be detected, and extracting code structure information of the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, scopes of custom variables, custom variable call information, scopes of custom variable call information, custom functions, scopes of custom functions, custom function call information, and scopes of custom function call information; and extracting basic information based on the preset dangerous functions. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with the dangerous function information as the starting line number to perform threat information chain backtracking to obtain a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model performs detection and analysis on the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression device of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code, that is, the method of the present invention can restore the obfuscated PowerShell code, and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts.

[0074] Optionally, the restoration and code structure information extraction unit is also used to: convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree to obtain a processed abstract syntax tree; decompile the processed abstract syntax tree to obtain the restored PowerShell source code to be detected.

[0075] Optionally, the generation unit is further used to: determine the scope of each line of statement code according to the code structure information, and organize the scope through a tree structure to obtain a scope tree, and then determine the scope tuple of each line of statement code according to the scope of each line of statement code and the scope tree, wherein the name of the node in the scope tree is the name of the Function or Class, which is identified as the scope, and the data information is the starting row and the ending row of the scope; extract the custom variable from the first target field of the code structure information, and use the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable; use the Python Re library to compare the custom variable with the restored PowerShell to be detected l The source code is matched line by line to obtain the custom variable calling information, and the scope of the custom variable calling information is determined according to whether the custom variable called by the custom variable calling information belongs to the variable inside the custom class; the custom function is extracted from the second target field of the code structure information, and the second to last scope in the scope tuple of the statement code corresponding to the custom function is used as the scope of the custom function; the custom function is matched with the restored PowerShell source code to be detected by line using Python's Re library to obtain the custom function calling information, and the scope of the custom function calling information is determined according to whether the custom function called by the custom function calling information belongs to the function inside the custom class.

[0076] Optionally, the generation unit is also used to: traverse the code structure information, and each time a Class structure or a Function structure is encountered, add 1 to the scope of the corresponding statement code, thereby obtaining the scope of each line of statement code, wherein the initial value of the scope is 0; reverse the path from the scope of each line of statement code to the scope of the root node of the scope tree as the scope tuple of the corresponding line of statement code; if the custom variable belongs to a variable inside a custom class, then the scope of the statement code of the custom class is used as the scope of the custom variable call information; if the custom variable does not belong to a variable inside a custom class, then the largest scope in the scope tuple of the custom variable call information is used as the scope of the custom variable call information.

[0077] Optionally, the first determination unit is also used to match the corresponding danger function rules with the code structure information in order from high to low danger levels, and when the matched danger function information reaches a preset number, the danger function rules of lower danger levels are no longer matched, thereby obtaining the danger function information of each line of statement code.

[0078] Optionally, the second determination unit is further used to: determine a variable definition line list according to the custom variables, and determine a variable call line list according to the custom variable call information; determine a selection condition domain for each line of statement code according to the code structure information, and organize the selection condition domain through a tree structure to obtain a selection condition tree, wherein in the selection condition tree, the name of the node is the selection condition domain of the corresponding statement code, and the data information is the starting row and the ending row of the selection condition domain; traverse the variable definition line list, and copy the variable definition line list and the variable call line list during each traversal; determine whether the scope corresponding to each variable call line in the variable call line list is equal to the last one in the scope tuple of the current variable definition line in the variable definition line list. A scope is defined, and the variable call line list is split into a list of restrictable variable call lines and a list of unrestricted variable call lines; the variable definition lines and variable call lines in the variable definition line list and the restrictable variable call line list that are less than or equal to the current variable definition line are deleted, and the remaining variable definition lines are sorted in ascending order to obtain a first filtered variable definition line list and a first filtered variable call line list; the variable definition lines and variable call lines of the custom variables with the same name as the current variable definition line and other than the branch to which the current variable definition line belongs are deleted from the first filtered variable definition line list and the first filtered variable call line list, to obtain a second filtered variable definition line list and the second filtered variable definition line list. The variable definition row list after the second filter is set; the closed flag is set to false, and the variable definition row list after the second filter is traversed; the relationship between the current second filtered variable definition row and the new second filtered variable definition row is determined according to the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined according to the selection condition tree; if the relationship is external inclusion and the selection condition to which the current second filtered variable definition row belongs is closed, it is determined that the scope of the new second filtered variable definition row covers the scope of the current second filtered variable definition row, and the selection condition to which the new second filtered variable definition row belongs is deleted from the variable definition row list after the second filter. All second filtered variable call lines after the closed structure tail line, and set the closed flag to true; if the relationship is contained / parallel, and the selection condition to which the current second filtered variable definition line belongs is closed, recursively determine whether the selection condition to which the new second filtered variable definition line belongs is closed, and delete all second filtered variable call lines between the closed structure tail line of the selection condition to which the current second filtered variable definition line belongs to and the closed structure tail line of the selection condition to which the new second filtered variable definition line belongs in the second filtered variable call line list until the recursive termination condition is met, wherein the contained recursive termination condition is: reaching the selection condition domain of the current second filtered variable definition line;The parallel recursive cutoff condition is: reaching the maximum selection condition domain in the intersection of the selection condition path of the current second filtered variable definition line and the selection condition path of the new second filtered variable definition line; if the selection condition corresponding to the recursive cutoff condition is closed, then delete all variable call lines after the closed structure tail line of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs in the above-mentioned deleted variable call line list, and set the closed flag to true; after completing the traversal of the second filtered variable definition line list or the closed flag is true, concatenate the variable call line list finally obtained with the unrestricted variable call line list to obtain the variable call line information of the custom variable of the current variable definition line, until all variable definition lines in the variable definition line list are traversed, and the variable call line information of the custom variables of all variable definition lines is obtained; according to the custom function and the custom function call information, obtain the function call line information of the custom functions of all function definition lines, and use the variable call line information of the custom variables of all variable definition lines and the function call line information of the custom functions of all function definition lines as the call information backtracking library. ;

[0079] Optionally, the backtracking unit is further used to: take the line number of the statement code with the dangerous function information as the starting line number, start backtracking in the call information backtracking library, obtain the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and save the target custom variable and / or target custom function and the new line number in the first dictionary, and save the backtraced custom variables and their line numbers, the backtraced custom functions and their line numbers in the second dictionary, wherein, when saving the backtraced custom variables and their line numbers, the backtraced custom functions and their line numbers in the second dictionary, determine whether the token sum of the line numbers saved in the second dictionary exceeds a predefined length, and if so, merge and output the line numbers of the second dictionary; determine the new line to be backtraced and the new line to be backtraced in the call information backtracking library according to the first dictionary The target custom variable and / or new custom function is obtained by deleting the source custom variable or source custom function of the target custom variable and / or the target custom function from the new line to be backtraced, the new custom variable and / or the new custom function, and deleting the information in the second dictionary from the new line to be backtraced, the new custom variable and / or the new custom function, to obtain the target new line to be backtraced, and then taking the target new line to be backtraced as the starting line number, returning to execute the step of starting backtracing in the call information backtracing library until there is no target new line to be backtraced, or the sum of the tokens of all the line numbers in the second dictionary obtained by backtracing exceeds the predefined length, and then obtaining the compressed threat information chain line number according to the line number that has been backtraced, wherein the number of compressed threat information chain line numbers is equal to the number of statement codes with dangerous function information.

[0080] Optionally, the merging unit is further used to: determine the Token length corresponding to each row in the compressed threat information chain row number, and calculate the total Token number of each compressed threat information chain row number according to the Token length corresponding to each row in the compressed threat information chain row number; determine the target compressed threat information chain row number corresponding to the maximum Token number in each compressed threat information chain row number according to the total Token number of each compressed threat information chain row number; calculate the number of intersection Tokens of other compressed threat information chain row numbers and the target compressed threat information chain row number, and sort the other compressed threat information chain row numbers in descending order of the number of intersection Tokens; and determine in sequence whether the current compressed threat information chain row number in the sorted sequence is equal to the target compressed threat information chain row number. whether the threat information chain line numbers after the union exceeds the predefined length; if not, the current compressed threat information chain line number is taken as the union with the target compressed threat information chain line number, and the current compressed threat information chain line number is deleted from other compressed threat information chain line numbers, and the threat information chain line number after the union is taken is used as the compressed threat information chain line number, and the step of determining the target compressed threat information chain line number corresponding to the maximum total number of Tokens in each compressed threat information chain line number is returned to execute until the merge is impossible, and the merged threat information chain line number is obtained; each merged threat information chain line number is converted according to the correspondence between the line number and the statement code to obtain the compressed threat information chain code.

[0081] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0082] like Figure 5 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the PowerShell code restoration and compression method as described above.

[0083] Specifically, the memory 602 and the processor 601 can be general-purpose memories and processors, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the PowerShell code restoration and compression method can be executed.

[0084] The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The above processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0085] Corresponding to the above-mentioned PowerShell code restoration and compression method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned PowerShell code restoration and compression method.

[0086] The PowerShell code restoration and compression device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0087] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0088] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0089] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0090] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0091] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for enabling an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the PowerShell code restoration and compression method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program code.

[0092] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0093] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solution recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiment of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for restoring and compressing PowerShell code, characterized in that: include: Restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; Generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, scopes of custom variables, custom variable call information, scopes of custom variable call information, custom functions, scopes of custom functions, custom function call information, and scopes of custom function call information; Determine the dangerous function information of each line of statement code according to the preset dangerous function rules; Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; In the call information backtracking library, the line number of the statement code with the dangerous function information is used as the starting line number to backtrack the threat information chain to obtain the compressed threat information chain line number; Merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result; The compressed threat information chain code is input into the large model so that the large model detects and analyzes the compressed threat information chain code.

2. The method according to claim 1, characterized in that Restore the PowerShell code to be detected, including: Convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree, so as to obtain a processed abstract syntax tree; Decompile the processed abstract syntax tree to obtain the restored PowerShell source code to be detected.

3. The method according to claim 1, characterized in that Generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, including: Determine the scope of each line of statement code according to the code structure information, organize the scope through a tree structure to obtain a scope tree, and then determine the scope tuple of each line of statement code according to the scope of each line of statement code and the scope tree, wherein the name of the node in the scope tree is the name of the Function or Class, the identifier is the scope, and the data information is the start row and end row of the scope; Extract the custom variable from the first target field of the code structure information, and use the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable; Using Python's Re library, the custom variable is matched with the restored PowerShell source code to be detected line by line to obtain the custom variable call information, and the scope of the custom variable call information is determined according to whether the custom variable called by the custom variable call information belongs to a variable inside a custom class; Extract the user-defined function from the second target field of the code structure information, and use the second-to-last scope in the scope tuple of the statement code corresponding to the user-defined function as the scope of the user-defined function; Use Python's Re library to match the custom function with the restored PowerShell source code to be detected line by line to obtain the custom function call information, and determine the scope of the custom function call information based on whether the custom function called by the custom function call information belongs to a function inside a custom class.

4. The method according to claim 3, characterized in that Determining the scope of each line of statement code according to the code structure information includes: Traversing the code structure information, each time encountering a Class structure or a Function structure, adding 1 to the scope of the corresponding statement code, thereby obtaining the scope of each line of the statement code, wherein the initial value of the scope is 0; Determining a scope tuple of each line of the statement code according to the scope of each line of the statement code and the scope tree includes: Reversing the path from the scope of each line of the statement code to the scope of the root node of the scope tree as the scope tuple of the corresponding line of statement code; Determining the scope of the custom variable calling information according to whether the custom variable called by the custom variable calling information belongs to a variable inside a custom class includes: If the custom variable is a variable within a custom class, the scope of the statement code of the custom class is used as the scope of the custom variable calling information; If the custom variable does not belong to a variable within a custom class, the largest scope in the scope tuple of the custom variable calling information is used as the scope of the custom variable calling information.

5. The method according to claim 1, characterized in that Determine the dangerous function information of each line of statement code according to the preset dangerous function rules, including: The corresponding danger function rules are matched with the code structure information in order from high to low danger levels, and when the matched danger function information reaches a preset number, the danger function rules of lower danger levels are no longer matched, thereby obtaining the danger function information of each line of the statement code.

6. The method according to claim 1, characterized in that Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library, including: Determine a variable definition line list according to the custom variable, and determine a variable call line list according to the custom variable call information; Determine the selection condition domain of each line of statement code according to the code structure information, and organize the selection condition domain through a tree structure to obtain the selection condition tree, wherein the name of the node in the selection condition tree is the selection condition domain of the corresponding statement code, and the data information is the starting row and the ending row of the selection condition domain; Traversing the variable definition line list, and copying the variable definition line list and the variable call line list during each traversal; Splitting the variable call line list into a list of restrictable variable call lines and a list of unrestrictable variable call lines according to whether the scope corresponding to each variable call line in the variable call line list is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list; Delete the variable definition lines and variable call lines that are less than or equal to the current variable definition line in the variable definition line list and the restrictable variable call line list, and arrange the remaining variable definition lines in ascending order to obtain a first filtered variable definition line list and a first filtered variable call line list; Delete the variable definition lines and variable call lines of the user-defined variables with the same name as the current variable definition line and other than the branch to which the current variable definition line belongs from the first filtered variable definition line list and the first filtered variable call line list, to obtain the second filtered variable definition line list and the second filtered variable call line list; Set the closed flag to false, and traverse the second filtered list of variable definition lines; determining a relationship between the current second filtered variable definition row and the new second filtered variable definition row according to a selection condition path of the current second filtered variable definition row and a selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined according to the selection condition tree; If the relationship is outer inclusion, and the selection condition to which the current second filtered variable definition row belongs is closed, it is determined that the scope of the new second filtered variable definition row covers the scope of the current second filtered variable definition row, and all second filtered variable call rows after the selection condition closed row are deleted from the second filtered variable call row list, and the closed flag is set to true; If the relationship is inner inclusion / parallel, and the selection condition to which the current second filtered variable definition row belongs is closed, then recursively determine whether the selection condition to which the new second filtered variable definition row belongs is closed, and delete all second filtered variable call rows between the closed structure tail row of the selection condition to which the current second filtered variable definition row belongs to and the closed structure tail row of the selection condition to which the new second filtered variable definition row belongs in the second filtered variable call row list until the recursive termination condition is satisfied, wherein the inner inclusion recursive termination condition is: reaching the selection condition domain of the current second filtered variable definition row; the parallel recursive termination condition is: reaching the maximum selection condition domain in the intersection of the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row; If the selection condition corresponding to the recursive cutoff condition is closed, then in the deleted variable call line list, delete all variable call lines after the closed structure tail line of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs, and set the closed flag to true; After the traversal of the second filtered variable definition line list is completed or the closed flag is true, the variable call line list finally obtained is concatenated with the unrestricted variable call line list to obtain the variable call line information of the custom variable of the current variable definition line, until the traversal of all variable definition lines in the variable definition line list is completed to obtain the variable call line information of the custom variables of all variable definition lines; According to the user-defined function and the user-defined function calling information, the function calling line information of the user-defined function in all function definition lines is obtained, and the variable calling line information of the user-defined variables in all variable definition lines and the function calling line information of the user-defined function in all function definition lines are used as the calling information backtracking library.

7. The method according to claim 1, characterized in that The line number of the statement code with dangerous function information is used as the starting line number to trace back the threat information chain, and the compressed threat information chain line number is obtained, including: Taking the line number of the statement code with dangerous function information as the starting line number, starting backtracking in the call information backtracking library, obtaining the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and saving the target custom variable and / or the target custom function and the new line number in the first dictionary, and saving the backtracked custom variables and their line numbers, the backtracked custom functions and their line numbers in the second dictionary, wherein when saving the backtracked custom variables and their line numbers, the backtracked custom functions and their line numbers in the second dictionary, determining whether the token sum of the line numbers saved in the second dictionary exceeds a predefined length, and if so, merging the line numbers of the second dictionary and outputting them; According to the first dictionary, a new line to be backtraced, a new custom variable and / or a new custom function is determined in the call information backtracing library, and the source custom variable or source custom function of the target custom variable and / or the target custom function is deleted from the new line to be backtraced, the new custom variable and / or the new custom function, and the information in the second dictionary is deleted from the new line to be backtraced, the new custom variable and / or the new custom function, to obtain a target new line to be backtraced, and then the target new line to be backtraced is used as the starting line number, and the step of starting backtracing in the call information backtracing library is returned to execute until there is no target new line to be backtraced, or the sum of the tokens of all line numbers in the second dictionary obtained by backtracing exceeds the predefined length, and then the compressed threat information chain line number is obtained according to the line number that has been backtraced, wherein the number of the compressed threat information chain line numbers is equal to the number of the statement codes with dangerous function information.

8. The method according to claim 1, characterized in that The compressed threat information chain line numbers are merged, and the compressed threat information chain code is obtained according to the corresponding relationship between the line number and the statement code in the merged result, including: Determine the token length corresponding to each row in the compressed threat information chain row number, and calculate the total number of tokens of each compressed threat information chain row number according to the token length corresponding to each row in the compressed threat information chain row number; Determine the target compressed threat information chain row number corresponding to the maximum total number of Tokens in each compressed threat information chain row number according to the total number of Tokens in each compressed threat information chain row number; Calculate the number of intersection tokens of other compressed threat information chain row numbers and the target compressed threat information chain row number, and sort the other compressed threat information chain row numbers in descending order of the number of intersection tokens; Determine in sequence whether the union of the current compressed threat information chain row number and the target compressed threat information chain row number in the sorted sequence exceeds a predefined length; If it does not exceed, then the current compressed threat information chain row number and the target compressed threat information chain row number are taken as the union, and the current compressed threat information chain row number is deleted from the other compressed threat information chain row numbers, and the threat information chain row number after the union is taken is used as the compressed threat information chain row number, and the step of determining the target compressed threat information chain row number corresponding to the maximum total number of Tokens in each compressed threat information chain row number is returned to execute, until the merger cannot be performed, and the merged threat information chain row number is obtained; Each of the merged threat information chain line numbers is converted according to the corresponding relationship between the line number and the statement code to obtain the compressed threat information chain code.

9. A device for restoring and compressing PowerShell code, characterized in that: include: The restoration and code structure information extraction unit is used to restore the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extract the code structure information of the restored PowerShell source code to be detected to obtain the code structure information of the restored PowerShell source code to be detected; A generating unit, configured to generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: a custom variable, a scope of a custom variable, custom variable call information, a scope of the custom variable call information, a custom function, a scope of a custom function, custom function call information, and a scope of the custom function call information; A first determining unit, configured to determine the dangerous function information of each line of statement code according to a preset dangerous function rule; a second determination unit, configured to process the selection conditions in the restored PowerShell source code to be detected into a tree structure, and determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information by using the obtained selection condition tree, thereby obtaining a call information backtracking library; A backtracking unit, used to use the line number of the statement code with dangerous function information as the starting line number in the call information backtracking library to backtrack the threat information chain and obtain a compressed threat information chain line number; A merging unit, used to merge the compressed threat information chain line numbers, and obtain the compressed threat information chain code according to the corresponding relationship between the line number and the statement code in the merging result; The input unit is used to input the compressed threat information chain code into the large model so that the large model detects and analyzes the compressed threat information chain code.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

Images