PHP website source code feature value automatic identification and labeling method and system

Abstract

The invention provides a method and a system for automatically identifying and labeling a PHP website source code characteristic value. The method comprises the following steps of: classifying and storing files in a file list through a directory tree structure of a PHP website source code; identifying the frame type of the PHP website source code through the characteristic value matching rate; identifying a home page and a background entry of the PHP website; identifying and labeling database types and database connection information of the PHP website source codes in combination with the matching rule feature library and a configuration mode and common keywords of a database of the PHP website; third-party platform interface information of a PHP website source code and a fourth-party payment interface and a third-party cloud storage interface called by a PHP website are subjected to regular matching identification in a link mode, key links of related interfaces are searched, and interface information is marked; and marking a characteristic value of the PHP website source code by using the identified information, and constructing portrait information of the PHP website source code. According to the method, the feature value and the key information of the PHP website source code can be quickly identified, labeled and displayed, and the evidence obtaining efficiency of evidence obtaining personnel is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and system for automatically identifying and marking characteristic values ​​of PHP website source codes. Background Art

[0002] With the continuous development of network technology, PHP, as a popular server-side scripting language, is widely used in Web development. Some criminals use PHP website source code to build illegal websites to carry out criminal activities. In the process of collecting evidence, it is often necessary to fix the website source code for analysis, or collect a large amount of website source code and need to analyze it one by one. There are many PHP website source code frameworks. If the forensic personnel lack website development experience, it is difficult to quickly analyze the website source code of various types of sites developed based on ThinkPHP, Laravel, Discuz, etc.

[0003] Moreover, analyzing PHP website source code is a complicated task. Currently, the analysis of PHP website source code on the market mainly generates directory structure and class diagram. Although it helps to understand the organization of the code base, it cannot identify the key information of the PHP website source code. Other PHP source code contents need to be analyzed manually, but manual analysis requires forensic personnel to have an in-depth understanding of PHP source code or have programming experience. In the prior art, forensic personnel manually view the source code based on keywords or according to their experience in handling cases to view configuration files to obtain information. In addition, manual analysis takes a lot of time and energy. When analyzing a large amount of code logic, it is inevitable to miss key information, and the accuracy of the forensic results cannot be guaranteed. It is difficult to quickly screen the website source code involved in the case when performing batch analysis on multiple sites.

[0004] Based on the above reasons, how to automatically identify the key information of the website source code, mark the website source code, and quickly output the website source code feature information has become an urgent problem to be solved. Summary of the invention

[0005] The present invention proposes the following technical solutions to address one or more technical deficiencies in the above-mentioned prior art.

[0006] Based on the first aspect of the present invention, a method for automatically identifying and marking PHP website source code feature values ​​is proposed, comprising:

[0007] S1: construct a directory tree structure of the PHP website source code and classify and store different types of files in the file list of the directory tree structure;

[0008] S2: Calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table, and identify the framework type of the PHP website source code according to the feature value matching rate;

[0009] S3: Analyze the entry file of the PHP website source code in combination with the module entry, the controller entry and the routing entry to identify the homepage and the backend entry of the PHP website;

[0010] S4: In response to the pre-built matching rule feature library, and in combination with the configuration mode and common keywords of the database of the PHP website, identifying and marking the database type and database connection information of the PHP website source code;

[0011] S5: Perform regular matching on the PHP website source code by linking, identify the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, search for key links of related interfaces and mark the interface information;

[0012] S6: Use all the identified information to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

[0013] Using link-based regular matching to identify PHP source code has high flexibility and can be adjusted according to different needs. When processing large amounts of data, it can quickly match and extract the required information, improve processing efficiency, and ensure that the extracted links are accurate.

[0014] Furthermore, the different types of files in the file list of the directory tree structure include PHP files, HMTL files, JavaScript files, CSS files and picture files.

[0015] Furthermore, before the S2 step, it also includes: parsing the framework of the PHP website source code, extracting different types of framework code file samples and generating file hash values ​​through a hash function, and then mapping the file hash values ​​and corresponding feature values ​​and storing them in a hash table.

[0016] Furthermore, the configuration mode of the user, password, host name and database name of the database in the PHP website source code is analyzed by big data technology to form a matching rule feature library.

[0017] Furthermore, after step S4 and before step S5, it also includes judging whether the database is a local database or a remote database according to the host name. If it is a remote database, it further judges the platform where the remote database is deployed and the access rights, and marks the database connection information.

[0018] Furthermore, after the step S5, the method further includes identifying the website business type through the header title information of the static page file of the PHP website source code, wherein the website business type includes forum, blog and mall;

[0019] Identify sensitive information, including contact information of R&D personnel.

[0020] Furthermore, after the S5 step, the encryption method of the PHP website login password is analyzed and the login password and encryption algorithm of the PHP website are identified.

[0021] Based on the second aspect of the present invention, a system for automatically identifying and marking PHP website source code feature values ​​is also proposed, comprising:

[0022] Directory tree module: constructs the directory tree structure of the PHP website source code and classifies and stores different types of files in the file list of the directory tree structure;

[0023] Framework identification module: Calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table and identify the framework type of the PHP website source code according to the feature value matching rate;

[0024] Entry identification module: Combine the module entry, controller entry and routing entry to analyze the entry file of the PHP website source code and identify the homepage and backend entry of the PHP website;

[0025] Database identification module: In response to the pre-built matching rule feature library, and in combination with the configuration mode and common keywords of the database of the PHP website, identify and mark the database type and database connection information of the PHP website source code;

[0026] Interface identification module: performs regular matching on the PHP website source code by linking, identifies the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, searches for key links of related interfaces and marks the interface information;

[0027] Portrait construction module: use all the information obtained by identification to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

[0028] Based on the third aspect of the present invention, a computer program product is also proposed, comprising one or more computer programs, and when the computer program is executed by a computer processor, any of the above methods is implemented.

[0029] The technical effect of the present invention is that the present invention can quickly identify key information of PHP website source code and mark it, automatically analyze feature values, perform manual correction according to the recognition results, and continuously optimize and update the feature library, thereby reducing the workload of manual analysis, improving the accuracy and efficiency of recognition, and improving the efficiency of evidence collection by evidence collectors. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Other features, objects and advantages of the present application will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings.

[0031] Figure 1 The present invention provides an overall flow chart of a method for automatically identifying and marking PHP website source code feature values ​​according to an embodiment of the present invention.

[0032] Figure 2 The present invention provides a system framework diagram for automatically identifying and annotating PHP website source code feature values ​​according to an embodiment of the present invention.

[0033] Figure 3 It is a logic diagram for realizing a system for automatically identifying and marking PHP website source code feature values ​​provided according to an embodiment of the present invention.

[0034] Figure 4 It is a server forensics website topology rendering provided according to an embodiment of the present invention.

[0035] Figure 5 It is a website reconstruction feature information diagram provided according to an embodiment of the present invention.

[0036] Figure 6 It is a schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0038] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] Figure 1 A flow chart of a method for automatically identifying and marking PHP website source code feature values ​​provided by an embodiment of the present invention is shown, comprising:

[0040] S1: construct a directory tree structure of the PHP website source code and classify and store different types of files in the file list of the directory tree structure;

[0041] S2: Calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table, and identify the framework type of the PHP website source code according to the feature value matching rate;

[0042] S3: Analyze the entry file of the PHP website source code in combination with the module entry, the controller entry and the routing entry to identify the homepage and the backend entry of the PHP website;

[0043] S4: In response to the pre-built matching rule feature library, and in combination with the configuration mode and common keywords of the database of the PHP website, identifying and marking the database type and database connection information of the PHP website source code;

[0044] S5: Perform regular matching on the PHP website source code by linking, identify the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, search for key links of related interfaces and mark the interface information;

[0045] S6: Use all the identified information to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

[0046] It should be noted that the different types of files in the file list of the directory tree structure include PHP files, HMTL files, JavaScript files, CSS files and picture files.

[0047] It should be noted that before the S2 step, it also includes: parsing the framework of the PHP website source code, extracting different types of framework code file samples and generating file hash values ​​through a hash function, and then mapping the file hash values ​​and corresponding feature values ​​and storing them in a hash table.

[0048] It should be noted that the configuration mode of the user, password, host name and database name of the database in the PHP website source code is analyzed by big data technology to form a matching rule feature library.

[0049] It should be noted that after step S4 and before step S5, the process further includes determining whether the database is a local database or a remote database based on the host name. If it is a remote database, the platform on which the remote database is deployed and the access rights are further determined, and the database connection information is marked.

[0050] It should be noted that the step S5 further includes identifying the website business type through the header information of the static page file of the PHP website source code, and the website business type includes forum, blog and mall;

[0051] Identify sensitive information, including contact information of R&D personnel.

[0052] It should be noted that, after the step S5, the encryption method of the PHP website login password is analyzed and the login password and encryption algorithm of the PHP website are identified.

[0053] In a specific embodiment, the framework types of the PHP website source code include ThinkPHP, Larave l and Discuz.

[0054] In a specific embodiment, the class objects of the database include MySQL, PostgreSQL and SQLite.

[0055] It should be noted that the third-party platform interface information can quickly locate the identity of relevant personnel, including registration information of the payment system and customer service system.

[0056] It should be noted that the directory tree structure is a file system structure organized in a tree form, usually with a root directory as the center and multiple branches extending downward to form a tree-like structure.

[0057] It should be noted that in the PHP website source code, you can use the hash_file function to obtain the hash value of a file, such as MD5, SHA1, or SHA256.

[0058] It should be noted that the so-called fourth-party payment refers to a payment channel that has not obtained a national payment and settlement license, violates the national payment and settlement system, relies on regular third-party payment platforms such as Alipay and Tenpay, and is illegally built through a large number of registered merchants or personal accounts.

[0059] It should be noted that the third-party storage interfaces include Amazon S3 and OpenStack Swift.

[0060] It should be noted that the characteristic values ​​of PHP source code include file structure, naming conventions, code style, database interaction and exception handling implementation information.

[0061] It should be noted that the use of link-based regular matching to identify PHP source code has high flexibility and can be adjusted according to different needs. When processing large amounts of data, it can quickly match and extract the required information, improve processing efficiency, and ensure that the extracted links are accurate.

[0062] It should be noted that the present invention can quickly identify and mark the key information of the PHP website source code, automatically analyze the feature values, perform manual correction according to the recognition results, and continuously optimize and update the feature library, thereby reducing the workload of manual analysis, improving the accuracy and efficiency of recognition, and improving the efficiency of evidence collection by evidence collectors.

[0063] Figure 2 The system framework diagram of the present invention for automatically identifying and annotating PHP website source code feature values ​​includes a directory tree module a, a framework identification module b, an entry identification module c, a database identification module d, an interface identification module e and a portrait construction module f. The specific logic diagram is shown in FIG. Figure 3 shown.

[0064] In a specific embodiment, the directory tree module a is configured to construct a directory tree structure of the PHP website source code and classify and store different types of files in the file list of the directory tree structure.

[0065] In a specific embodiment, the framework identification module b is configured to calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table, and identify the framework type of the PHP website source code according to the feature value matching rate.

[0066] In a specific embodiment, the entry identification module c is configured to combine the module entry, the controller entry and the routing entry to analyze the entry file of the PHP website source code and identify the homepage and backend entry of the PHP website.

[0067] In a specific embodiment, the database identification module d is configured to respond to a pre-built matching rule feature library, and in combination with the configuration method and common keywords of the database of the PHP website, identify and annotate the database type and database connection information of the PHP website source code.

[0068] In a specific embodiment, the interface identification module e is configured to perform regular matching on the PHP website source code using a link method, identify the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, search for key links of related interfaces and mark the interface information.

[0069] In a specific embodiment, the portrait construction module f is configured to use all the identified information to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

[0070] In a specific embodiment, the relevant technology in this application has been applied to the construction of server forensic website topology map and the identification of website reconstruction feature information, and has achieved good results, such as Figure 4 and Figure 5 As shown;

[0071] Forensic website topology diagram Figure 4As shown, the Nginx 1.22.1 source code written in PHP language in the website "fi r.xyz 121.40.255.116" is analyzed according to the method described in this application to obtain the configuration related information of the local mysql database "fenfa", including the host name, port, user, password, database name, location and file path; the identified website reconstruction feature information is as follows Figure 5 As shown, the type of PHP website source code framework is Laravel, the backend entrance is admin, the website adopts bcypt's website encryption method, and the obtained database configuration related information can quickly rebuild the website.

[0072] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application. Figure 6 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0073] like Figure 6 As shown, the computer system includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. Various programs and data required for system operation are also stored in the RAM 603. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0074] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0075] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable storage medium of the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wireless, wireline, optical cable, RF, etc., or any suitable combination of the foregoing.

[0076] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0077] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0078] The modules involved in the embodiments of the present application may be implemented by software or by hardware.

[0079] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: constructs a directory tree structure of the PHP website source code and classifies and stores different types of files in the file list of the directory tree structure; calculates the file hash value of the PHP website source code in combination with the directory tree structure, identifies the framework type of the PHP website source code by comparing the feature value with the hash table and according to the feature value matching rate; analyzes the entry file of the PHP website source code in combination with the module entry, the controller entry and the routing entry, and identifies the homepage and backend entry of the PHP website; identifies and marks the database type and database connection information of the PHP website source code in response to the pre-constructed matching rule feature library and in combination with the configuration mode and common keywords of the database of the PHP website; performs regular matching on the PHP website source code in a link mode, identifies the third-party platform interface information of the PHP website source code, and the fourth-party payment interface and third-party cloud storage interface called by the PHP website, searches for key links of related interfaces and marks the interface information; marks the feature value of the PHP website source code using all the information obtained by identification, and constructs the portrait information of the PHP website source code.

[0080] Finally, it should be noted that the above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for automatically identifying and marking characteristic values ​​of PHP website source code, characterized in that: include: S1: construct a directory tree structure of the PHP website source code and classify and store different types of files in the file list of the directory tree structure; S2: Calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table, and identify the framework type of the PHP website source code according to the feature value matching rate; S3: Analyze the entry file of the PHP website source code in combination with the module entry, the controller entry and the routing entry to identify the homepage and the backend entry of the PHP website; S4: In response to the pre-built matching rule feature library, and in combination with the configuration mode and common keywords of the database of the PHP website, identifying and marking the database type and database connection information of the PHP website source code; S5: Perform regular matching on the PHP website source code by linking, identify the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, search for key links of related interfaces and mark the interface information; S6: Use all the identified information to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

2. The method according to claim 1, characterized in that The different types of files in the file list of the directory tree structure include PHP files, HMTL files, JavaScript files, CSS files and picture files.

3. The method according to claim 1, characterized in that: Before the S2 step, the following also includes: parsing the framework of the PHP website source code, extracting different types of framework code file samples and generating file hash values ​​through a hash function, and then mapping the file hash values ​​and corresponding feature values ​​and storing them in a hash table.

4. The method according to claim 1, characterized in that The configuration mode of the user, password, host name and database name of the database in the PHP website source code is analyzed by big data technology to form a matching rule feature library.

5. The method according to claim 1, characterized in that After step S4 and before step S5, the process further includes determining whether the database is a local database or a remote database based on the host name. If it is a remote database, the platform on which the remote database is deployed and the access rights are further determined, and the database connection information is marked.

6. The method according to claim 1, characterized in that After the step S5, the step further includes identifying the website business type through the header title information of the static page file of the PHP website source code, wherein the website business type includes forum, blog and mall; Identify sensitive information, including contact information of R&D personnel.

7. The method according to claim 1, characterized in that The step S5 also includes analyzing the encryption method of the PHP website login password and identifying the login password and encryption algorithm of the PHP website.

8. A system for automatically identifying and marking PHP website source code feature values, characterized in that: include: Directory tree module: constructs the directory tree structure of the PHP website source code and classifies and stores different types of files in the file list of the directory tree structure; Framework identification module: Calculate the file hash value of the PHP website source code in combination with the directory tree structure, compare the feature value with the hash table and identify the framework type of the PHP website source code according to the feature value matching rate; Entry identification module: Combine the module entry, controller entry and routing entry to analyze the entry file of the PHP website source code and identify the homepage and backend entry of the PHP website; Database identification module: In response to the pre-built matching rule feature library, and in combination with the configuration mode and common keywords of the database of the PHP website, identify and mark the database type and database connection information of the PHP website source code; Interface identification module: performs regular matching on the PHP website source code by linking, identifies the third-party platform interface information of the PHP website source code, as well as the fourth-party payment interface and third-party cloud storage interface called by the PHP website, searches for key links of related interfaces and marks the interface information; Portrait construction module: use all the information obtained by identification to mark the characteristic values ​​of the PHP website source code and construct the portrait information of the PHP website source code.

9. A computer program product comprising one or more computer programs, characterized in that When the computer program is executed by a computer processor, the method according to any one of claims 1 to 7 is implemented.

Images