PowerShell code restoration and compression method, device, and electronic device

Abstract

The present invention provides a method, device, and electronic device for restoring and compressing PowerShell code, belonging to the technical field of network security. The method can restore PowerShell code to be detected and obtain a compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that a large model can accurately detect the regular compressed threat information chain code. That is, the method of the present invention can restore obfuscated PowerShell code and compress the long restored PowerShell source code to be detected into a compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method, device and electronic device for restoring and compressing PowerShell codes. Background Art

[0002] PowerShell is a powerful command-line interface (CLI) and scripting language developed by Microsoft. It is designed for system administrators and developers to manage systems and automate tasks. With PowerShell, users can perform various system management tasks, such as configuring system settings, managing users and permissions, and monitoring system performance.

[0003] However, PowerShell's powerful capabilities can also be exploited by malicious users to create malicious scripts. These malicious scripts can perform unauthorized actions, such as stealing sensitive information, damaging system files, and spreading malware. Because PowerShell scripts can easily bypass certain security restrictions, they have become a common tool in cyberattacks.

[0004] Currently, there are three main PowerShell-based detection methods: the first is the traditional detection method based on fingerprints, feature libraries, blacklists, etc., which is limited by the lag of existing knowledge and cannot effectively detect new malicious code; the second is to extract dynamic and static features of the code and use machine learning or deep learning models for training and identification. However, traditional methods require manual design of feature extractors and rely on the knowledge and experience of domain experts. They also perform poorly when dealing with long-distance dependencies, especially when dealing with complex data such as text and code; the third is to use large models for malicious code detection (large models have a strong ability to understand context) and can well analyze and detect regular samples (samples refer to PowerShell scripts / PowerShell code), but they are not effective when facing obfuscated samples and have context restrictions (scripts that are too long cannot be entered), which is very resource-consuming for detecting large samples.

[0005] In summary, how to effectively detect obfuscated scripts and large scripts has become a technical problem that needs to be solved urgently. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a method, device and electronic device for restoring and compressing PowerShell code to alleviate the technical problem that the existing technology cannot effectively detect obfuscated scripts and large scripts.

[0007] In a first aspect, an embodiment of the present invention provides a method for restoring and compressing PowerShell code, comprising:

[0008] Restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to obtain code structure information of the restored PowerShell source code to be detected;

[0009] generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, scopes of custom variables, custom variable call information, scopes of custom variable call information, custom functions, scopes of custom functions, custom function call information, and scopes of custom function call information;

[0010] Determine the dangerous function information of each line of statement code according to the preset dangerous function rules;

[0011] Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine variable call line information of the custom variable in each variable definition line in the basic information and function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library;

[0012] In the call information backtracking library, the line number of the statement code with the dangerous function information is used as the starting line number to backtrack the threat information chain to obtain the compressed threat information chain line number;

[0013] Merging the compressed threat information chain line numbers, and obtaining a compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result;

[0014] The compressed threat information chain code is input into a large model so that the large model detects and analyzes the compressed threat information chain code.

[0015] In an embodiment of the present invention, a method for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, the scope of custom variables, custom variable call information, the scope of custom variable call information, custom functions, the scope of custom functions, custom function call information, and the scope of custom function call information; and extracting basic information based on the preset risk function. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with dangerous function information as the starting line number to perform threat information chain backtracking, and obtaining a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining a compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model can detect and analyze the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code. That is, the method of the present invention can restore the obfuscated PowerShell code and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A flowchart of a PowerShell code restoration and compression method provided by an embodiment of the present invention;

[0018] Figure 2 A schematic diagram of the code structure information of the PowerShell source code to be detected after restoration provided by an embodiment of the present invention;

[0019] Figure 3 A flowchart of obtaining variable call line information of a custom variable in a variable definition line provided by an embodiment of the present invention;

[0020] Figure 4 A schematic diagram of a PowerShell code restoration and compression device provided by an embodiment of the present invention;

[0021] Figure 5 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] The following will clearly and completely describe the technical solutions of the present invention in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0023] Traditional technologies cannot effectively detect obfuscated scripts and large scripts.

[0024] Based on this, the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code. That is, the method of the present invention can restore the obfuscated PowerShell code and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code.

[0025] To facilitate understanding of this embodiment, a PowerShell code restoration and compression method disclosed in an embodiment of the present invention is first introduced in detail.

[0026] Example 1:

[0027] According to an embodiment of the present invention, an embodiment of a method for restoring and compressing PowerShell code is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Figure 1 is a flowchart of a PowerShell code restoration and compression method according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0029] Step S102: Restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to obtain code structure information of the restored PowerShell source code to be detected;

[0030] Specifically, obfuscating malicious PowerShell scripts is a primary method used by hackers to circumvent conventional malware detection methods. This can also hinder effective threat information extraction. Therefore, restoring obfuscated scripts is essential. This involves restoring the PowerShell code to be detected. The detailed restoration process is described below and is not detailed here.

[0031] After obtaining the restored PowerShell source code to be tested, the code structure information is extracted. The extracted code structure information will be used for subsequent processing steps. The extracted code structure information includes: information of various types of statements, including: assignment statement information, function definition information, class definition information, etc. The information of each type of statement includes rich detailed information. Taking the assignment statement information as an example, it includes: variable name, line number where the assignment statement is located, source of the variable (normal assignment, Param parameter, ${} assignment, Set-Variable, Set-Item, variable assignment in Foreach, and $global and $script assignments, etc.). Figure 2 As shown, the code structure information of the restored PowerShell source code to be detected is shown.

[0032] Step S104: generating basic information for threat extraction based on the restored PowerShell source code and code structure information to be detected, wherein the basic information includes: custom variables, custom variable scopes, custom variable call information, custom variable call information scopes, custom functions, custom function scopes, custom function call information, and custom function call information scopes;

[0033] Step S106, determining the dangerous function information of each line of statement code according to a preset dangerous function rule;

[0034] Step S108: Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library;

[0035] Step S110: In the call information backtracking library, the line number of the statement code containing the dangerous function information is used as the starting line number to perform threat information chain backtracking to obtain the compressed threat information chain line number;

[0036] Step S112: Merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the correspondence between the line numbers and the statement codes in the merging result;

[0037] Step S114: input the compressed threat information chain code into the large model, so that the large model detects and analyzes the compressed threat information chain code.

[0038] Specifically, if there are multiple compressed threat information chain codes, these compressed threat information chain codes are simultaneously detected and analyzed in parallel to improve detection efficiency.

[0039] In an embodiment of the present invention, a method for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to be detected to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, the scope of custom variables, custom variable call information, the scope of custom variable call information, custom functions, the scope of custom functions, custom function call information, and the scope of custom function call information; and extracting basic information based on the preset risk function. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with dangerous function information as the starting line number to perform threat information chain backtracking, and obtaining a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining a compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model can detect and analyze the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression method of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code. That is, the method of the present invention can restore the obfuscated PowerShell code and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts.

[0040] The above content briefly introduces the PowerShell code restoration and compression method of the present invention. The specific contents involved are described in detail below.

[0041] In an optional embodiment of the present invention, restoring the PowerShell code to be detected specifically includes the following steps:

[0042] (1) Convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree in the abstract syntax tree to obtain the processed abstract syntax tree;

[0043] Specifically, the PowerShell code to be tested is converted into an abstract syntax tree (AST). An AST is a tree-like data structure that represents the structure of source code. It is used to parse the syntax of the code into a hierarchical format for easier analysis and processing.

[0044] The generated abstract syntax tree is then traversed. When a subtree that can be calculated is found, such as when the subtree corresponding to the statement code "{1}{0}" -f 'x','ie' is found, and the string formatting statement code can be calculated to produce the result 'iex', a string node is generated using the result 'iex' to replace the original subtree. When no subtree in the abstract syntax tree can be calculated, the traversal of the abstract syntax tree is exited, and the processed abstract syntax tree is obtained.

[0045] (2) Decompile the abstract syntax tree to obtain the restored PowerShell source code to be tested.

[0046] In an optional embodiment of the present invention, generating basic information for threat extraction based on the restored PowerShell source code and code structure information to be detected specifically includes the following steps:

[0047] (1) Determine the scope of each line of statement code based on the code structure information, and organize the scope through a tree structure to obtain a scope tree. Then, determine the scope tuple of each line of statement code based on the scope of each line of statement code and the scope tree. In the scope tree, the name of the node is the name of the function or class, the identifier is the scope, and the data information is the start and end rows of the scope.

[0048] Specifically, before extracting custom variables and custom functions, the scope information is processed first, because only the variable name and scope together can identify a custom variable. The scope information is processed as follows:

[0049] Traverse the code structure information, and every time you encounter a Class structure or a Function structure, add 1 to the scope of the corresponding statement code, and then get the scope of each line of statement code, where the initial value of the scope is 0.

[0050] During implementation, the code structure is traversed. Each time a Class or Function structure is encountered, the corresponding Scope_Id (scope) value is incremented by 1. The initial value is 0. Scope_Ids are also organized into a tree structure to facilitate handling nested functions. The Tag (tree node name) of the Scope_Tree node is the Function or Class name, the ID (identifier) ​​is the Scope_Id (scope), and the Data information is the start and end rows of the Scope_Id.

[0051] In addition, the path from the scope of each statement line to the scope of the root node of the scope tree is reversed to form the scope tuple of the corresponding statement line. For example, if the scope of the current statement is 3, and the path from the scope to the root node of the scope tree is (3, 2, 1, 0), reversing this path (3, 2, 1, 0) yields (0, 1, 2, 3), which is the scope tuple of the current statement line.

[0052] (2) extracting the custom variable from the first target field of the code structure information, and taking the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable;

[0053] Specifically, the extraction of custom variable information includes two parts: extraction of custom variables and extraction of custom variable call information. These two parts are explained in turn below.

[0054] Custom variables are extracted from the Assign field (the first target field) in the code structure information. These include various custom variables: standard assignments, Param parameters, ${} assignments, Set-Variable, Set-Item, variable assignments in Foreach, and assignments such as $global and $script. After extraction, scope information must be added to the custom variable. The last scope in the line scope tuple of the statement corresponding to the custom variable is used as the scope of the custom variable. This is identified by adding the scope to @VD (VD stands for Variable Define). For example, $a@VD0 indicates that the custom variable is $a and its corresponding scope is 0.

[0055] (3) Use Python's Re library to match the custom variables with the restored PowerShell source code to be detected line by line to obtain the custom variable call information, and determine the scope of the custom variable call information based on whether the custom variable called by the custom variable call information belongs to the variable inside the custom class;

[0056] Specifically, custom variable call information needs to be matched using Python's Re library. Using Python's Re library, each line of the restored PowerShell source code to be tested is matched against all custom variables obtained from assign, ultimately obtaining the custom variable call information for each line. The scope information of custom variable call information is handled in two ways, depending on whether the called custom variable belongs to a variable within a custom class. If the custom variable belongs to an internal variable of a class, its scope (i.e., the scope of the statement code of the custom class) is found in the previous Scope_Tree based on the class information, and this is used as the scope of the custom variable call information. If it is just ordinary custom variable call information, the largest scope in the scope tuple of the statement code of the custom variable call information is used as the scope of the custom variable call information. For example, custom variable call information is identified as "@V" plus the scope, such as $a@V0, where $a indicates that the called custom variable is $a and the corresponding scope is 0. That is, if the custom variable belongs to a variable inside a custom class, the scope of the statement code of the custom class will be used as the scope of the custom variable call information; if the custom variable does not belong to a variable inside a custom class, the largest scope in the scope tuple of the custom variable call information will be used as the scope of the custom variable call information.

[0057] (4) extracting the custom function from the second target field of the code structure information, and taking the second-to-last scope in the scope tuple of the statement code corresponding to the custom function as the scope of the custom function;

[0058] Specifically, the extraction of user-defined function information also includes two parts: extraction of user-defined functions and extraction of user-defined function call information. These two parts are explained in turn below.

[0059] The custom function is extracted from the Class and Function sections of the code structure information. Then, the custom function name and "@FD" (FD stands for Function Define) plus the second-to-last scope of the scope tuple of the statement code line are used as the scope of the custom function. For example, LoadLibrary@FD1, where the custom function is LoadLibrary and the corresponding scope is 1.

[0060] In PowerShell, when extracting a custom function, not only should the custom function of that line be extracted and identified, but the custom function identifier of that line should also be added to the line where the param parameter of the function exists, so that subsequent function calls can be traced back to the complete function definition.

[0061] (5) Use Python's Re library to match the custom function with the restored PowerShell source code to be detected line by line to obtain the custom function call information, and determine the scope of the custom function call information based on whether the custom function called by the custom function call information belongs to the function inside the custom class.

[0062] Specifically, custom function call information is also matched using Python's Re library (similar to the process for determining custom variable call information). The scope of custom function call information is handled in the same way as the scope of custom variable call information. The custom function call identifier is then added with "@F" to the scope. For example, LoadLibrary@F1, where "LoadLibrary" indicates that the custom function being called is LoadLibrary, and the corresponding scope is 1.

[0063] It should be noted that the code block structure information to which each line of statement code belongs needs to be determined based on the restored PowerShell source code to be detected.

[0064] Specifically, to maintain a complete code structure after threat extraction, the structure information line number of each line must be added to the line number to form the Structure_List (i.e., the structure information of the code block to which the statement code in that line belongs). To subsequently extract a line of statement code, all lines of statement code in the Structure_List information for that line must be extracted. For ease of understanding, the following example code shows that the structure information line numbers for this function are [1,2,5], meaning that lines 1, 2, and 5 are complete. Therefore, the Structure_List for lines 1, 2, and 5 is [1,2,5], the Structure_List for line 3 is [1,2,3,5], and the fourth line is [1,2,4,5].

[0065] 1, function LoadLibrary

[0066] 2, {

[0067] 3, $dll = [System.Reflection.Assembly]::LoadFile($dllPath)

[0068] 4, return $dll

[0069] 5,}

[0070] In an optional embodiment of the present invention, determining the dangerous function information of each line of statement code according to a preset dangerous function rule specifically includes the following steps:

[0071] The corresponding dangerous function rules are matched with the code structure information in order from high to low dangerous levels. When the matched dangerous function information reaches a preset number, the dangerous function rules of lower dangerous levels will no longer be matched, and the dangerous function information of each line of statement code will be obtained.

[0072] Specifically, each line of code is matched against dangerous functions. The matching dangerous function rules include: dangerous Cmdlet commands, dangerous NativeCommands, and IL dangerous functions. Dangerous functions are classified as single-rule dangerous functions and multi-rule dangerous functions. Single-rule dangerous functions, such as Set-ItemProperty, Out-File, and Cscript.exe, are classified as dangerous functions. Multi-rule dangerous functions are classified as dangerous only when multiple functions appear simultaneously. For example, the simultaneous appearance of {"Class": "Convert", "Function": "FromBase64String"} and {"Class": "Reflection.Assembly", "Function": "Load"} is considered dangerous. Dangerous functions have different danger levels. To extract sufficient threat information from the code while minimizing the amount of information extracted, dangerous function rules are matched from high to low danger levels. (To minimize threat information loss and improve compression efficiency, high-risk dangerous functions are prioritized.) Once the preset number of matched dangerous function information is reached, matching against lower-risk dangerous function rules is discontinued. During the processing, the matched single-rule hazard function information and multi-rule hazard function information should be stored separately. This is because in the subsequent threat information extraction stage, the multi-rule hazard function needs to backtrack across multiple rows to generate the same compressed threat information chain row number; while the single-rule hazard function only needs to backtrack a single row.

[0073] Custom variables are restricted based on selection conditions such as If-Else, Try-Catch, and Switch to ensure that within the same scope, even if there are multiple assignments and calls of custom variables with the same name, the custom variables called by the custom variable call information can still be accurately traced back. In an optional embodiment of the present invention, the selection conditions in the restored PowerShell source code to be detected are processed into a tree structure, and the obtained selection condition tree is used to determine the variable call line information of the custom variables in each variable definition line in the basic information and the function call line information of the custom functions in each function definition line in the basic information, thereby obtaining a call information backtracking library, which specifically includes the following steps:

[0074] (1) Determine the variable definition line list based on the custom variable, and determine the variable call line list based on the custom variable call information;

[0075] Specifically, first generate Variable_define_dict (i.e., variable definition dictionary) and Variable_call_dict (i.e., variable call dictionary). Variable_define_dict stores information about variable definitions: the key is the custom variable, and the value is all the rows where the custom variable appears; Variable_call_dict stores information about variable calls: the key is the custom variable call information, and the value is all the rows where the custom variable call information appears.

[0076] (2) Determine the selection condition domain of each line of statement code based on the code structure information, and organize the selection condition domain through a tree structure to obtain a selection condition tree, where the name of the node in the selection condition tree is the selection condition domain of the corresponding statement code, and the data information is the starting row and ending row of the selection condition domain;

[0077] Specifically, the selection condition field (i.e., Associated_id) starts at 0 and increments by 1 each time a new selection condition is encountered. The same selection condition shares the same Associated_id. When constructing the selection condition tree, the root node's tag and ID are both set to 0. Each time a new selection condition node is added, the ID (node ​​identifier) ​​is incremented, and the tag (i.e., name) is set to the selection condition field value of the corresponding statement code. Furthermore, each tree node contains data information: Start_line and End_line.

[0078] (3) Traverse the variable definition line list and copy the variable definition line list and variable call line list each time;

[0079] Specifically, according to Figure 3 The steps shown traverse the list of variable definition lines. That is, iterate over the keys and values ​​in Variable_define_dict to successfully implement variable restrictions. The following is a detailed description of the algorithm with the help of the sample code snippet:

[0080] 1, $number = 3

[0081] 2. $flag = Read-Host "Please enter a value (true / false)"

[0082] 3. Write-Output "$number"

[0083] 4, if ($flag -gt 3) {

[0084] 5, $number = 7

[0085] 6, if ($flag -gt 9) {

[0086] 7, $number = 10

[0087] 8. Write-Output "$number"

[0088] 9,}

[0089] 10, if ($flag -gt 12) {

[0090] 11, $number = 21

[0091] 12. Write-Output "$number"

[0092] 13,}

[0093] 14,} else {

[0094] 15, $number = 9

[0095] 16. Write-Output "$number"

[0096] 17,}

[0097] 18, $number = 17

[0098] 19. Write-Output "$number"

[0099] In the above code segment, the variable definition line list of the custom variable $number is [1,5,7,11,15,18], where each number indicates that the statement code of the corresponding line is the variable definition line of the custom variable $number. The statement code on line 1 defines the value of the custom variable $number as 3. The variable call line list is [3,8,12,16,19], where each number indicates that the statement code of the corresponding line is the variable call line of the custom variable $number. For example, the statement code on line 3 calls the custom variable $number.

[0100] Traverse the variable definition line list and copy the variable definition line list and variable call line list each time. All subsequent variable definition line lists and variable call line lists will use the copy.

[0101] (4) Split the variable call line list into a list of restricted variable call lines and a list of unrestricted variable call lines based on whether the scope corresponding to each variable call line in the variable call line list is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list;

[0102] Specifically, if the scope corresponding to a variable call line in the variable call line list (that is, the scope of the custom variable call information of the variable call line) is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list (that is, the scope tuple of the statement code of the current variable definition line), then the variable call behavior can restrict the variable call line; if not equal, then the variable call behavior cannot restrict the variable call line.

[0103] (5) Delete the variable definition lines and variable call lines that are less than or equal to the current variable definition line in the variable definition line list and the restricted variable call line list, and sort the remaining variable definition lines in ascending order to obtain the first filtered variable definition line list and the first filtered variable call line list;

[0104] Specifically, since the same custom variable is defined first and then called under the same scope, it is necessary to delete the variable definition lines and variable call lines in the variable definition line list and the restricted variable call line list that are less than or equal to the current variable definition line, and then sort the remaining variable definition lines from small to large to obtain the first filtered variable definition line list and the first filtered variable call line list, so that when a custom variable is closed subsequently, all variable call lines after the selection condition to which the closed line belongs can be directly deleted, and then the loop can be exited to reduce the running time.

[0105] (6) Delete the variable definition lines and variable call lines of the custom variables with the same name as the current variable definition line and other than the branch to which the current variable definition line belongs from the first filtered variable definition line list and the first filtered variable call line list, and obtain the second filtered variable definition line list and the second filtered variable call line list;

[0106] Specifically, in the first filtered list of variable definition lines and variable call lines, delete all custom variable definition lines and variable call lines that have the same selection criteria as the current variable definition line and belong to a branch other than the current variable definition line. For example, if you are currently traversing line 5 of the custom variable $number, you should delete line 15 in the first filtered list of variable definition lines and line 16 in the first filtered list of variable call lines.

[0107] (7) Set the closed flag to false and traverse the list of variable definition lines after the second filter;

[0108] Specifically, the initial value of the close flag Close_flag is set to False. Then, the variable definition line list after the second filtering is traversed.

[0109] (8) determining a relationship between the current second filtered variable definition row and the new second filtered variable definition row based on a selection condition path of the current second filtered variable definition row and a selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined based on a selection condition tree;

[0110] Specifically, the new second filtered variable definition line traverses the second filtered variable definition lines in the second filtered variable definition line list.

[0111] The selection condition path of the current second filtered variable definition row is all selection condition fields on the path from the current second filtered variable definition row to the root node in the selection condition tree. The selection condition path of the new second filtered variable definition row is all selection condition fields on the path from the new second filtered variable definition row to the root node in the selection condition tree.

[0112] The above relationships include: internal inclusion, external inclusion and parallel relationships.

[0113] a) Inner inclusion: When the selection condition path of the variable definition row after the second filter truly includes the selection condition path of the variable definition row after the current filter. For example, consider rows 5 and 7 of the custom variable $number. The selection condition path in row 5 is Path1 = {0,1}, and the selection condition path in row 7 is Path2 = {0,1,2}. Path2 truly includes Path1, indicating an inner inclusion relationship.

[0114] b) Outer inclusion: When the selection condition path of the current second-filtered variable definition row includes the selection condition path of the new second-filtered variable definition row. For example, consider the variable $number in rows 5 and 18. The selection condition path in row 5 is Path1 = {0,1}, and the selection condition path in row 18 is Path2 = {0}. Path1 includes Path2, creating an outer inclusion relationship.

[0115] c) Parallel: The specific calculation logic is to calculate the intersection of the selection condition path of the current second-filtered variable definition row and the selection condition path of the new second-filtered variable definition row. The intersection must be a proper subset of the selection condition path of the current second-filtered variable definition row and the selection condition path of the new second-filtered variable definition row. Take the custom variable $number in rows 7 and 11 as an example. The node path in row 7 is Path1 = {0,1,2}, and the node path in row 11 is Path2 = {0,1,3}. The intersection Path3 = {0,1}, and Path3 is a proper subset of Path1 and Path2. Therefore, it is a parallel relationship.

[0116] (9) If the relationship is outer inclusion and the selection condition of the current second filtered variable definition line is closed, then the scope of the new second filtered variable definition line is determined to cover the scope of the current second filtered variable definition line, and all second filtered variable call lines after the selection condition closed line are deleted from the second filtered variable call line list, and the closed flag is set to true;

[0117] Specifically, the above relationship is used to determine whether a custom variable is closed. Closed means that all selected conditions within the same custom variable definition must contain a closed custom variable definition. As shown in the code snippet above, line 18 closes the selected condition for line 4, so line 19 can be deleted.

[0118] (10) If the relationship is inner inclusion / parallel, and the selection condition of the current second filtered variable definition row is closed, then recursively determine whether the selection condition of the new second filtered variable definition row is closed, and delete all second filtered variable call rows between the closed structure tail row of the selection condition of the current second filtered variable definition row and the closed structure tail row of the selection condition of the new second filtered variable definition row in the second filtered variable call row list until the recursive termination condition is met, wherein the recursive termination condition of inner inclusion is: reaching the selection condition domain of the current second filtered variable definition row; the recursive termination condition of parallel is: reaching the maximum selection condition domain in the intersection of the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row;

[0119] Specifically, recursively determine whether the selection condition to which the variable definition line after the new second filter belongs is closed. That is, if the structure of the current selection condition is closed (for example, it is a complete if-else structure, which is closed), then determine whether the upper-level selection condition structure is closed, and at the same time delete the variable call line numbers between the last line of the closed structure and the last line of the upper-level closed structure.

[0120] (11) If the selection condition corresponding to the recursive cutoff condition is closed, then delete all variable call lines after the last line of the closed structure of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs in the above-mentioned deleted variable call line list, and set the closed flag to true;

[0121] (12) After the traversal of the variable definition line list after the second filter is completed or the closed flag is true, the variable call line list finally obtained and the unrestricted variable call line list are spliced ​​to obtain the variable call line information of the custom variable of the current variable definition line, until the traversal of all variable definition lines in the variable definition line list is completed, and the variable call line information of the custom variable of all variable definition lines is obtained;

[0122] Specifically, define_call_dict is used to collect the variable call line information for the custom variable in the current variable definition line. Its key is the line number, and its value is a new dictionary. The key of the new dictionary is the custom variable that exists on that line, and the value is the set of line numbers to which the variable should be backtracked during backtracking (i.e., the variable call line information). The following is an example of define_call_dict lines 1 to 3: {1: {'$number@VD0': {3}}, 2: '$flag@VD0': {4, 6, 10}}, 3: {'$number@V0': {1}}}. This essentially represents the correspondence between the variable definition line number, the custom variable, and the variable call line information.

[0123] (13) According to the custom function and the custom function call information, the function call line information of the custom function in all function definition lines is obtained, and the variable call line information of the custom variable in all variable definition lines and the function call line information of the custom function in all function definition lines are used as the call information backtracking library.

[0124] Specifically, since define_call_dict only contains custom variables and their corresponding variable call line information, the custom functions and custom function call information that were previously matched by line should be added to define_call_dict in the format. Of course, custom functions do not need to be restricted by variables.

[0125] In an optional embodiment of the present invention, the line number of the statement code containing the dangerous function information is used as the starting line number to perform threat information chain backtracking to obtain the compressed threat information chain line number, which specifically includes the following steps:

[0126] (1) Using the line number of the statement code with dangerous function information as the starting line number, start backtracking in the call information backtracking library, obtain the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and save the target custom variable and / or target custom function and the new line number in the first dictionary, and save the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary. When saving the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary, determine whether the token sum of the line number stored in the second dictionary exceeds the predefined length. If it exceeds, merge the line numbers of the second dictionary and output them;

[0127] Specifically, if it is a multi-rule hazard function, there are multiple starting rows.

[0128] (2) Determine a new line to be backtraced, a new custom variable and / or a new custom function in the call information backtracing library according to the first dictionary, delete the target custom variable and / or the source custom variable or source custom function of the target custom function from the new line to be backtraced, the new custom variable and / or the new custom function, and delete the information in the second dictionary from the new line to be backtraced, the new custom variable and / or the new custom function, and obtain the target new line to be backtraced, and then use the target new line to be backtraced as the starting line number, return to the step of starting backtracing in the call information backtracing library, until there is no target line to be backtraced, or the sum of the tokens of all line numbers in the second dictionary obtained by backtracing exceeds the predefined length, and then obtain the compressed threat information chain line number according to the line number that has been backtraced, wherein the number of compressed threat information chain line numbers is equal to the number of statement codes with dangerous function information.

[0129] Specifically, the new line number stored in the first dictionary is used as the new line to be backtracked, and the target custom variable and / or target custom function stored in the first dictionary is used as the new custom variable and / or new custom function. The source custom variable or source custom function of the target custom variable and / or target custom function is deleted from the new line to be backtracked, the new custom variable, and / or the new custom function. This is to avoid an infinite loop. For example, if the source is from $results@VD0, the new line to be backtracked will definitely contain $results@V0, so this key-value pair ($results@V0) needs to be filtered out. Furthermore, the information in the second dictionary is deleted from the new line to be backtracked, the new custom variable, and / or the new custom function. Since it has already been backtracked, there is no need to backtrack again, which shortens the runtime of the threat extraction algorithm. The deleted new line to be backtracked becomes the target new line to be backtracked.

[0130] For example, the row numbers of the compressed threat information chain are [1,3,7,8].

[0131] It should be noted that if you are tracing back the function definition line from a function call, you need to trace back the param associated with the function definition, that is, trace back all the lines containing the function definition (the function definition has been added to the line where the param exists).

[0132] If the param definition line is traced back from a param call, only the function definition needs to be traced back, and no other params need to be traced back.

[0133] In an optional embodiment of the present invention, the compressed threat information chain line numbers are merged, and the compressed threat information chain code is obtained according to the correspondence between the line numbers and the statement codes in the merged result, specifically including the following steps:

[0134] (1) Determine the token length corresponding to each row in the compressed threat information chain row number, and calculate the total number of tokens for each compressed threat information chain row number based on the token length corresponding to each row in the compressed threat information chain row number;

[0135] Specifically, in order to reduce the number of scripts obtained by the threat extraction operation, the scripts are merged according to the number of overlapping tokens between the scripts, thereby obtaining fewer scripts.

[0136] In implementation, if the token length for the first row of the compressed threat information chain [1,3,7,8] is 2, the token length for the third row is 6, the token length for the seventh row is 14, and the token length for the eighth row is 10, then the total number of tokens for the compressed threat information chain [1,3,7,8] is 2+6+14+10=32.

[0137] (2) Determine the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number according to the total number of tokens in each compressed threat information chain row number;

[0138] (3) Calculate the number of intersection tokens between the row numbers of other compressed threat information chains and the row numbers of the target compressed threat information chain, and sort the row numbers of other compressed threat information chains in descending order of the number of intersection tokens;

[0139] Specifically, the aforementioned other compressed threat information chain row numbers are all compressed threat information chain row numbers other than the target compressed threat information chain row number. If the row numbers of one other compressed threat information chain are [1, 3, 7, 9, 10] and the row numbers of the target compressed threat information chain are [1, 3, 7, 9, 15], then the intersection of the two is [1, 3, 7, 9]. The number of tokens in [1, 3, 7, 9] is then calculated, i.e., the total number of tokens in the first, third, seventh, and ninth rows.

[0140] (4) determining in sequence whether the union of the current compressed threat information chain row number and the target compressed threat information chain row number in the sorted sequence exceeds a predefined length;

[0141] (5) If it does not exceed the limit, the current compressed threat information chain row number and the target compressed threat information chain row number are taken as the union, and the current compressed threat information chain row number is deleted from the other compressed threat information chain row numbers. The threat information chain row number after the union is taken is used as the compressed threat information chain row number, and the step of determining the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number is returned to execute until the merger cannot be completed, and the merged threat information chain row number is obtained;

[0142] Specifically, if it exceeds the limit, no action will be taken.

[0143] (6) Convert each merged threat information chain line number into a compressed threat information chain code according to the correspondence between the line number and the statement code.

[0144] The PowerShell code restoration and compression method of this invention effectively addresses the limitations of large models in analyzing and detecting obfuscated samples by introducing PowerShell script deobfuscation technology. Furthermore, through innovative threat information extraction algorithms, large samples are efficiently compressed, ensuring a significant reduction in sample size without losing threat information. This improvement enables large models to process large samples more efficiently, improving detection accuracy and efficiency.

[0145] Example 2:

[0146] An embodiment of the present invention further provides a device for restoring and compressing PowerShell code. The device for restoring and compressing PowerShell code is mainly used to execute the method for restoring and compressing PowerShell code provided in the first embodiment of the present invention. The following is a detailed introduction to the device for restoring and compressing PowerShell code provided in the embodiment of the present invention.

[0147] Figure 4 is a schematic diagram of a PowerShell code restoration and compression device according to an embodiment of the present invention, such as Figure 4 As shown, the apparatus mainly includes: a restoration and code structure information extraction unit 10, a generation unit 20, a first determination unit 30, a second determination unit 40, a backtracking unit 50, a merging unit 60, and an input unit 70, wherein:

[0148] The restoration and code structure information extraction unit is used to restore the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extract the code structure information of the restored PowerShell source code to be detected to obtain the code structure information of the restored PowerShell source code to be detected;

[0149] a generating unit, configured to generate basic information for threat extraction based on the restored PowerShell source code and code structure information to be detected, wherein the basic information includes: custom variables, custom variable scopes, custom variable call information, custom variable call information scopes, custom functions, custom function scopes, custom function call information, and custom function call information scopes;

[0150] A first determining unit, configured to determine the dangerous function information of each line of statement code according to a preset dangerous function rule;

[0151] a second determining unit, configured to process the selection conditions in the restored PowerShell source code to be detected into a tree structure, and use the obtained selection condition tree to determine variable call line information of the custom variable in each variable definition line in the basic information and function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracing library;

[0152] A backtracking unit is used to use the line number of the statement code containing the dangerous function information as the starting line number in the call information backtracking library to backtrack the threat information chain and obtain the compressed threat information chain line number;

[0153] a merging unit, configured to merge the compressed threat information chain line numbers, and obtain the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result;

[0154] The input unit is used to input the compressed threat information chain code into the large model so that the large model can detect and analyze the compressed threat information chain code.

[0155] In an embodiment of the present invention, a device for restoring and compressing PowerShell code is provided, comprising: restoring a PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information of the restored PowerShell source code to be detected to obtain the code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, the scope of custom variables, custom variable call information, the scope of custom variable call information, custom functions, the scope of custom functions, custom function call information, and the scope of custom function call information; and extracting basic information based on the preset risk function. The method comprises the following steps: determining the dangerous function information of each line of statement code by using a number rule; processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; in the call information backtracking library, using the line number of the statement code with dangerous function information as the starting line number to perform threat information chain backtracking, and obtaining a compressed threat information chain line number; merging the compressed threat information chain line numbers, and obtaining a compressed threat information chain code according to the corresponding relationship between the line number and the statement code according to the merging result; and inputting the compressed threat information chain code into the large model so that the large model can detect and analyze the compressed threat information chain code. From the above description, it can be seen that the PowerShell code restoration and compression device of the present invention can restore the PowerShell code to be detected, and can obtain the compressed threat information chain code corresponding to the restored PowerShell source code to be detected, so that the large model can accurately detect the regular compressed threat information chain code. That is, the method of the present invention can restore the obfuscated PowerShell code and compress the long restored PowerShell source code to be detected into the compressed threat information chain code, so that the large model can effectively detect the compressed threat information chain code, alleviating the technical problem that traditional technology cannot effectively detect obfuscated scripts and large scripts.

[0156] Optionally, the restoration and code structure information extraction unit is further used to: convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree to obtain a processed abstract syntax tree; decompile the processed abstract syntax tree to obtain the restored PowerShell source code to be detected.

[0157] Optionally, the generation unit is further used to: determine the scope of each line of statement code according to the code structure information, and organize the scope through a tree structure to obtain a scope tree, and then determine the scope tuple of each line of statement code according to the scope of each line of statement code and the scope tree, wherein the name of the node in the scope tree is the name of the Function or Class, which is identified as the scope, and the data information is the starting row and the ending row of the scope; extract the custom variable from the first target field of the code structure information, and use the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable; use the Python Re library to compare the custom variable with the restored PowerShell to be detected l The source code is matched line by line to obtain custom variable call information, and the scope of the custom variable call information is determined based on whether the custom variable called by the custom variable call information belongs to the variable inside the custom class; the custom function is extracted from the second target field of the code structure information, and the second-to-last scope in the scope tuple of the statement code corresponding to the custom function is used as the scope of the custom function; the custom function is matched with the restored PowerShell source code to be detected line by line using Python's Re library to obtain custom function call information, and the scope of the custom function call information is determined based on whether the custom function called by the custom function call information belongs to the function inside the custom class.

[0158] Optionally, the generation unit is also used to: traverse the code structure information, and each time a Class structure or a Function structure is encountered, add 1 to the scope of the corresponding statement code, thereby obtaining the scope of each line of statement code, wherein the initial value of the scope is 0; reverse the path between the scope of each line of statement code and the scope of the root node of the scope tree as the scope tuple of the corresponding line of statement code; if the custom variable belongs to a variable inside a custom class, then the scope of the statement code of the custom class is used as the scope of the custom variable call information; if the custom variable does not belong to a variable inside a custom class, then the largest scope in the scope tuple of the custom variable call information is used as the scope of the custom variable call information.

[0159] Optionally, the first determination unit is also used to match the corresponding hazard function rules with the code structure information in order of hazard level from high to low, and when the matched hazard function information reaches a preset number, the hazard function rules of lower hazard levels will no longer be matched, thereby obtaining the hazard function information of each line of statement code.

[0160] Optionally, the second determination unit is further used to: determine the variable definition line list according to the custom variable, and determine the variable call line list according to the custom variable call information; determine the selection condition domain of each line of statement code according to the code structure information, and organize the selection condition domain through a tree structure to obtain a selection condition tree, wherein, in the selection condition tree, the name of the node is the selection condition domain of the corresponding statement code, and the data information is the starting row and the ending row of the selection condition domain; traverse the variable definition line list, and copy the variable definition line list and the variable call line list during each traversal; determine whether the scope corresponding to each variable call line in the variable call line list is equal to the last one in the scope tuple of the current variable definition line in the variable definition line list. A scope is used to split the variable call line list into a restricted variable call line list and an unrestricted variable call line list; the variable definition lines and variable call lines in the variable definition line list and the restricted variable call line list that are less than or equal to the current variable definition line are deleted, and the remaining variable definition lines are sorted in ascending order to obtain the first filtered variable definition line list and the first filtered variable call line list; in the first filtered variable definition line list and the first filtered variable call line list, the variable definition lines and variable call lines of the custom variables with the same name that belong to the same selection condition as the current variable definition line and are excluding the branch to which the current variable definition line belongs are deleted to obtain the second filtered variable definition line list and the second filtered variable definition line list. The variable definition row list after the second filter is set; the closed flag is set to false, and the variable definition row list after the second filter is traversed; the relationship between the current second filtered variable definition row and the new second filtered variable definition row is determined according to the selection condition path of the current second filtered variable definition row and the selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined according to the selection condition tree; if the relationship is outer inclusion and the selection condition to which the current second filtered variable definition row belongs is closed, it is determined that the scope of the new second filtered variable definition row covers the scope of the current second filtered variable definition row, and the selection condition to which the new second filtered variable definition row belongs is deleted from the variable definition row list after the second filter. All second filtered variable call lines after the last line of the closed structure are closed, and the closed flag is set to true; if the relationship is inclusive / parallel, and the selection condition of the current second filtered variable definition line is closed, then recursively determine whether the selection condition of the new second filtered variable definition line is closed, and delete all second filtered variable call lines between the last line of the closed structure of the selection condition of the current second filtered variable definition line to the last line of the closed structure of the selection condition of the new second filtered variable definition line in the second filtered variable call line list until the recursive termination condition is met, wherein the recursive termination condition of inclusive is: reaching the selection condition domain of the current second filtered variable definition line;The parallel recursive cutoff condition is: reaching the maximum selection condition domain in the intersection of the selection condition path of the current second-filtered variable definition line and the selection condition path of the new second-filtered variable definition line. If the selection condition corresponding to the recursive cutoff condition is closed, all variable call lines following the last closed structure line of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs are deleted from the deleted variable call line list, and the closed flag is set to true. After traversal of the second-filtered variable definition line list is completed or the closed flag is true, the resulting variable call line list is concatenated with the unrestricted variable call line list to obtain variable call line information for the custom variables of the current variable definition line. This continues until all variable definition lines in the variable definition line list are traversed, obtaining variable call line information for the custom variables of all variable definition lines. Based on the custom functions and custom function call information, function call line information for the custom functions of all function definition lines is obtained, and the variable call line information for the custom variables of all variable definition lines and the function call line information for the custom functions of all function definition lines are used as a call information backtracking library.

[0161] Optionally, the backtracking unit is further used to: take the line number of the statement code with the dangerous function information as the starting line number, start backtracking in the call information backtracking library, obtain the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and save the target custom variable and / or target custom function and the new line number in the first dictionary, and save the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary, wherein, when saving the backtracked custom variable and its line number, the backtracked custom function and its line number in the second dictionary, determine whether the token sum of the line number saved in the second dictionary exceeds the predefined length, and if so, merge the line numbers of the second dictionary and output; determine the new line to be backtracked and the new line to be backtracked in the call information backtracking library according to the first dictionary The target new line to be backtraced is obtained by deleting the source custom variable or source custom function of the target custom variable and / or target custom function from the new line to be backtraced, the new custom variable and / or the new custom function, and deleting the information in the second dictionary from the new line to be backtraced, the new custom variable and / or the new custom function, and obtaining the target new line to be backtraced, and then using the target new line to be backtraced as the starting line number, returning to the step of starting backtracing in the call information backtracing library until there is no target new line to be backtraced, or the sum of the tokens of all line numbers in the second dictionary obtained by backtracing exceeds the predefined length, and then obtaining the compressed threat information chain line number according to the line number that has been backtraced, wherein the number of compressed threat information chain line numbers is equal to the number of statement codes with dangerous function information.

[0162] Optionally, the merging unit is further used to: determine the length of the token corresponding to each row in the compressed threat information chain row number, and calculate the total number of tokens of each compressed threat information chain row number according to the length of the token corresponding to each row in the compressed threat information chain row number; determine the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number according to the total number of tokens of each compressed threat information chain row number; calculate the number of tokens of the intersection of other compressed threat information chain row numbers and the target compressed threat information chain row number, and sort the other compressed threat information chain row numbers in descending order of the number of tokens of the intersection; and determine in turn the intersection of the current compressed threat information chain row number and the target compressed threat information chain row number in the sorted sequence. Whether the threat information chain line numbers after the union exceeds the predefined length; if not, the current compressed threat information chain line number and the target compressed threat information chain line number are unioned, and the current compressed threat information chain line number is deleted from the other compressed threat information chain line numbers, and the threat information chain line number after the union is taken as the compressed threat information chain line number, and the step of determining the target compressed threat information chain line number corresponding to the maximum total number of tokens in each compressed threat information chain line number is returned to execute until no more merging is possible, thereby obtaining a merged threat information chain line number; each merged threat information chain line number is converted into a compressed threat information chain code according to the correspondence between the line number and the statement code.

[0163] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those in the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding content in the aforementioned method embodiment.

[0164] like Figure 5 As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the PowerShell code restoration and compression method as described above.

[0165] Specifically, the memory 602 and processor 601 can be general-purpose memories and processors, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, it can execute the PowerShell code restoration and compression method.

[0166] The processor 601 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 601 or by instructions in the form of software. The above-mentioned processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The various methods, steps, and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as being executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium well-known in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, etc. The storage medium is located in memory 602, and processor 601 reads the information in memory 602 and performs the steps of the above method in conjunction with its hardware.

[0167] Corresponding to the above-mentioned PowerShell code restoration and compression method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned PowerShell code restoration and compression method.

[0168] The device for restoring and compressing PowerShell codes provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference can be made to the corresponding contents in the aforementioned method embodiment. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0169] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0170] For another example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0171] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0172] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0173] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, or the part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for enabling an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the PowerShell code restoration and compression method described in each embodiment of this application. The aforementioned storage medium includes: USB flash drives, mobile hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media that can store program code.

[0174] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0175] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The scope of protection of the present application is not limited thereto. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-mentioned embodiments within the technical scope disclosed in the present application, or perform equivalent replacements for some of the technical features thereof. However, these modifications, changes, or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application. They should all be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for restoring and compressing PowerShell code, characterized in that: include: Restoring the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extracting code structure information from the restored PowerShell source code to obtain code structure information of the restored PowerShell source code to be detected; generating basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: custom variables, scopes of custom variables, custom variable call information, scopes of custom variable call information, custom functions, scopes of custom functions, custom function call information, and scopes of custom function call information; Determine the dangerous function information of each line of statement code according to the preset dangerous function rules; Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine variable call line information of the custom variable in each variable definition line in the basic information and function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library; In the call information backtracking library, the line number of the statement code with the dangerous function information is used as the starting line number to backtrack the threat information chain to obtain the compressed threat information chain line number; Merging the compressed threat information chain line numbers, and obtaining a compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result; Inputting the compressed threat information chain code into a large model so that the large model detects and analyzes the compressed threat information chain code; The restoration of the PowerShell code to be detected includes: Converting the PowerShell code to be detected into an abstract syntax tree, and replacing the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree, to obtain a processed abstract syntax tree; Decompile the processed abstract syntax tree to obtain the restored PowerShell source code to be detected.

2. The method according to claim 1, characterized in that Generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, including: Determine the scope of each line of statement code according to the code structure information, organize the scope through a tree structure to obtain a scope tree, and then determine the scope tuple of each line of statement code according to the scope of each line of statement code and the scope tree, wherein the name of the node in the scope tree is the name of the function or class, the identifier is the scope, and the data information is the start row and end row of the scope; Extract the custom variable from the first target field of the code structure information, and use the last scope in the scope tuple of the statement code corresponding to the custom variable as the scope of the custom variable; Using the Python Re library, the custom variable is matched with the restored PowerShell source code to be detected line by line to obtain the custom variable call information, and the scope of the custom variable call information is determined based on whether the custom variable called by the custom variable call information belongs to a variable within a custom class; Extract the user-defined function from the second target field of the code structure information, and use the second-to-last scope in the scope tuple of the statement code corresponding to the user-defined function as the scope of the user-defined function; Use Python's Re library to match the custom function with the restored PowerShell source code to be detected line by line to obtain the custom function call information, and determine the scope of the custom function call information based on whether the custom function called by the custom function call information belongs to a function within a custom class.

3. The method according to claim 2, characterized in that Determining the scope of each line of statement code according to the code structure information includes: Traversing the code structure information, each time encountering a Class structure or a Function structure, adding 1 to the scope of the corresponding statement code, thereby obtaining the scope of each line of the statement code, wherein the initial value of the scope is 0; Determining a scope tuple of each line of statement code according to the scope of each line of statement code and the scope tree includes: Reversing the path between the scope of each line of the statement code and the scope of the root node of the scope tree as the scope tuple of the corresponding line of statement code; Determining the scope of the custom variable calling information according to whether the custom variable called by the custom variable calling information belongs to a variable within a custom class includes: If the custom variable belongs to a variable within a custom class, the scope of the statement code of the custom class is used as the scope of the custom variable call information; If the custom variable does not belong to a variable within a custom class, the largest scope in the scope tuple of the custom variable calling information is used as the scope of the custom variable calling information.

4. The method according to claim 1, wherein Determine the dangerous function information of each line of statement code according to the preset dangerous function rules, including: The corresponding hazard function rules are matched with the code structure information in order from high to low hazard levels, and when the matched hazard function information reaches a preset number, the hazard function rules of lower hazard levels will no longer be matched, thereby obtaining the hazard function information of each line of the statement code.

5. The method according to claim 1, wherein Processing the selection conditions in the restored PowerShell source code to be detected into a tree structure, and using the obtained selection condition tree to determine the variable call line information of the custom variable in each variable definition line in the basic information and the function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracking library, including: Determine a variable definition line list according to the custom variable, and determine a variable call line list according to the custom variable call information; Determine the selection condition domain of each line of statement code according to the code structure information, and organize the selection condition domain in a tree structure to obtain the selection condition tree, wherein the name of the node in the selection condition tree is the selection condition domain of the corresponding statement code, and the data information is the starting row and the ending row of the selection condition domain; Traversing the variable definition line list, and copying the variable definition line list and the variable call line list during each traversal; Splitting the variable call line list into a list of restrictable variable call lines and a list of unrestrictable variable call lines according to whether the scope corresponding to each variable call line in the variable call line list is equal to the last scope in the scope tuple of the current variable definition line in the variable definition line list; Delete the variable definition lines and variable call lines that are less than or equal to the current variable definition line in the variable definition line list and the restrictable variable call line list, and sort the remaining variable definition lines in ascending order to obtain a first filtered variable definition line list and a first filtered variable call line list; Delete variable definition lines and variable call lines of user-defined variables with the same name as the current variable definition line and other than the branch to which the current variable definition line belongs from the first filtered variable definition line list and the first filtered variable call line list, to obtain a second filtered variable definition line list and a second filtered variable call line list; Set the closed flag to false, and traverse the second filtered list of variable definition lines; determining a relationship between the current second filtered variable definition row and the new second filtered variable definition row according to a selection condition path of the current second filtered variable definition row and a selection condition path of the new second filtered variable definition row, wherein the selection condition path is determined according to the selection condition tree; If the relationship is outer inclusion and the selection condition to which the current second filtered variable definition row belongs is closed, determining that the scope of the new second filtered variable definition row covers the scope of the current second filtered variable definition row, deleting all second filtered variable call rows after the selection condition closed row in the second filtered variable call row list, and setting the closed flag to true; If the relationship is inner inclusion / parallel, and the selection condition to which the variable definition row after the current second filter belongs is closed, recursively determine whether the selection condition to which the variable definition row after the new second filter belongs is closed, and delete all second filtered variable call rows between the last row of the closed structure of the selection condition to which the variable definition row after the current second filter belongs to and the last row of the closed structure of the selection condition to which the variable definition row after the new second filter belongs from the second filtered variable call row list until a recursive termination condition is satisfied, wherein the recursive termination condition for inner inclusion is: reaching the selection condition domain of the variable definition row after the current second filter; the recursive termination condition for parallel is: reaching the maximum selection condition domain in the intersection of the selection condition path of the variable definition row after the current second filter and the selection condition path of the variable definition row after the new second filter; If the selection condition corresponding to the recursive cutoff condition is closed, then all variable call lines after the last line of the closed structure of the selection condition to which the closed line corresponding to the recursive cutoff condition belongs are deleted from the deleted variable call line list, and the closed flag is set to true; After completing the traversal of the variable definition line list after the second filter or the closed flag is true, the variable call line list finally obtained is concatenated with the unrestricted variable call line list to obtain the variable call line information of the custom variable of the current variable definition line, until completing the traversal of all variable definition lines in the variable definition line list to obtain the variable call line information of the custom variables of all variable definition lines; According to the custom function and the custom function calling information, the function calling line information of the custom function in all function definition lines is obtained, and the variable calling line information of the custom variables in all variable definition lines and the function calling line information of the custom function in all function definition lines are used as the calling information backtracing library.

6. The method according to claim 1, characterized in that The line number of the statement code containing the dangerous function information is used as the starting line number to trace back the threat information chain, and the compressed threat information chain line number is obtained, including: Using the line number of the statement code with dangerous function information as the starting line number, starting backtracking in the call information backtracking library, obtaining the target custom variable and / or target custom function corresponding to the new line number and the starting line number, and saving the target custom variable and / or the target custom function and the new line number in a first dictionary, and saving the backtracked custom variables and their line numbers, and the backtracked custom functions and their line numbers in a second dictionary. When saving the backtracked custom variables and their line numbers, and the backtracked custom functions and their line numbers in the second dictionary, determining whether the token sum of the line numbers already saved in the second dictionary exceeds a predefined length, and if so, merging the line numbers in the second dictionary and outputting the result; A new line to be backtraced, a new custom variable, and / or a new custom function are determined in the call information backtracing library according to the first dictionary, and the source custom variable or source custom function of the target custom variable and / or the target custom function is deleted from the new line to be backtraced, the new custom variable, and / or the new custom function, and the information in the second dictionary is deleted from the new line to be backtraced, the new custom variable, and / or the new custom function to obtain a target new line to be backtraced. The target new line to be backtraced is then used as the starting line number, and the step of starting backtracing in the call information backtracing library is returned to and executed until there is no target new line to be backtraced, or the sum of the tokens of all line numbers in the second dictionary obtained by backtracing exceeds the predefined length. The compressed threat information chain line number is then obtained according to the backtraced line number, wherein the number of the compressed threat information chain line numbers is equal to the number of statement codes with dangerous function information.

7. The method according to claim 1, characterized in that Merging the compressed threat information chain line numbers, and obtaining the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result, including: Determine the token length corresponding to each row in the compressed threat information chain row number, and calculate the total number of tokens for each compressed threat information chain row number based on the token length corresponding to each row in the compressed threat information chain row number; Determine the target compressed threat information chain row number corresponding to the maximum total number of tokens in each compressed threat information chain row number according to the total number of tokens in each compressed threat information chain row number; Calculate the number of intersection tokens between the row numbers of other compressed threat information chains and the row number of the target compressed threat information chain, and sort the row numbers of other compressed threat information chains in descending order of the number of intersection tokens; determining in sequence whether a union of a current compressed threat information chain row number and a target compressed threat information chain row number in the sorted sequence exceeds a predefined length; If not, the current compressed threat information chain row number and the target compressed threat information chain row number are taken as the union, and the current compressed threat information chain row number is deleted from the other compressed threat information chain row numbers. The threat information chain row number after taking the union is used as the compressed threat information chain row number, and the process returns to the step of determining the target compressed threat information chain row number corresponding to the maximum total number of tokens in each of the compressed threat information chain row numbers according to the total number of tokens in each of the compressed threat information chain row numbers, until no more merging is possible, thereby obtaining a merged threat information chain row number. Each merged threat information chain line number is converted according to the correspondence between the line number and the statement code to obtain the compressed threat information chain code.

8. A device for restoring and compressing PowerShell code, characterized in that: include: a restoration and code structure information extraction unit, configured to restore the PowerShell code to be detected to obtain the restored PowerShell source code to be detected, and extract code structure information from the restored PowerShell source code to obtain code structure information of the restored PowerShell source code to be detected; a generating unit, configured to generate basic information for threat extraction based on the restored PowerShell source code to be detected and the code structure information, wherein the basic information includes: a custom variable, a scope of the custom variable, custom variable call information, a scope of the custom variable call information, a custom function, a scope of the custom function, custom function call information, and a scope of the custom function call information; A first determining unit is used to determine the dangerous function information of each line of statement code according to a preset dangerous function rule; a second determining unit, configured to process the selection conditions in the restored PowerShell source code to be detected into a tree structure, and use the obtained selection condition tree to determine variable call line information of the custom variable in each variable definition line in the basic information and function call line information of the custom function in each function definition line in the basic information, thereby obtaining a call information backtracing library; A backtracking unit, configured to use the line number of the statement code containing the dangerous function information as the starting line number in the call information backtracking library to backtrack the threat information chain and obtain a compressed threat information chain line number; a merging unit, configured to merge the compressed threat information chain line numbers, and obtain the compressed threat information chain code according to the corresponding relationship between the line numbers and the statement codes in the merging result; An input unit, configured to input the compressed threat information chain code into a large model, so that the large model detects and analyzes the compressed threat information chain code; The restoration and code structure information extraction unit is further configured to: convert the PowerShell code to be detected into an abstract syntax tree, and replace the subtree in the abstract syntax tree based on the calculation result of the statement code corresponding to the subtree to obtain a processed abstract syntax tree; and decompile the processed abstract syntax tree to obtain the restored PowerShell source code to be detected.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

Images