Webshell detection method and system and electronic equipment

Abstract

The invention provides a Webshell detection method and system and electronic equipment. The method comprises the following steps: acquiring a behavior data set; for each URL, determining whether the URL is a suspicious URL with suspicious behaviors or not according to whether the behavior attribute data of the URL under the plurality of dimensions meets a corresponding threshold condition or not; extracting behavior characteristics of each suspicious URL from the behavior data set; according to the behavior characteristics of the plurality of suspicious URLs, screening risk URLs conforming to Webshell characteristics from the plurality of suspicious URLs; and generating a Webshell detection result according to whether the risk URL meets a preset association matching condition or not. In the mode, the potential Webshell can be identified by extracting and analyzing the URL behavior data, so that the efficiency and the accuracy of Webshell detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a Webshell detection method, system and electronic device. Background Art

[0002] Webshell is a malicious script that attackers upload to the server through vulnerabilities, allowing remote control of the server, execution of commands, theft of data, or deployment of other malware. It often enters the server through file upload vulnerabilities, SQL (Structured Query Language) injection, etc., becoming a gateway for attackers to gain remote access.

[0003] Existing processing methods include file content detection technology based on static code analysis and network traffic monitoring technology based on traffic analysis. Static analysis relies on comparing known features and function patterns to identify malicious scripts, but there are problems of missed reports and false positives, and it cannot detect encrypted or in-memory Webshells; traffic analysis monitors data flows through deep packet inspection, but encrypted communications and tunneling technologies may lead to missed reports and introduce network delays. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a Webshell detection method, system and electronic device, which can identify Webshell without relying on file content or traffic packet content, thereby effectively avoiding the problems of underreporting and false alarm in traditional static analysis and traffic monitoring methods, thereby improving the accuracy of Webshell detection.

[0005] In a first aspect, an embodiment of the present invention provides a Webshell detection method, comprising: obtaining a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions of multiple URLs (Uniform Resource Locator, Uniform Resource Locator System), and the behavior attribute data of a normal URL and a risk URL in the same dimension are different; for each URL, determining whether the URL is a suspicious URL with suspicious behavior according to whether the behavior attribute data of the URL in multiple dimensions meets corresponding threshold conditions; extracting behavior features of each suspicious URL from the behavior data set; screening out risk URLs that meet Webshell features from multiple suspicious URLs according to the behavior features of multiple suspicious URLs; and generating a Webshell detection result according to whether the risk URL meets a preset association matching condition.

[0006] This application can effectively distinguish normal URLs from risky URLs and accurately detect Webshells by acquiring and analyzing multi-dimensional behavior attribute data and combining the first-dimensional and second-dimensional behavior characteristics.

[0007] Furthermore, the behavioral characteristics of the URL include at least two of the following characteristics: a first type of characteristics, including the number of page visits and / or session visit depth of the user to the URL; a second type of characteristics, including the number of resources loaded by the URL, the information entropy of the request IP requesting access to the URL, and / or the number of access client types; a third type of characteristics, including the URL's request packet parameter variance, response packet variance, and / or the number of page operations.

[0008] Furthermore, based on the behavioral characteristics of multiple suspicious URLs, risky URLs that meet the Webshell characteristics are screened out from the multiple suspicious URLs, including: when the behavioral characteristics include the first type of characteristics, clustering the first type of characteristics of the multiple suspicious URLs, and determining the suspicious URLs whose distance from the cluster center URL is less than a first preset distance from the multiple suspicious URLs to form a first suspicious URL set; when the behavioral characteristics include the second type of characteristics, clustering the second type of characteristics of the multiple suspicious URLs, and determining the suspicious URLs whose distance from the cluster center URL is less than a second preset distance from the multiple suspicious URLs to form a second suspicious URL set; when the behavioral characteristics include the third type of characteristics, performing isolation forest processing on the third type of characteristics of the multiple suspicious URLs to determine abnormal third type characteristics, and forming a third suspicious URL set for the suspicious URLs with abnormal third type characteristics; and determining the risky URLs that meet the Webshell characteristics based on the intersection of at least two of the first suspicious URL set, the second suspicious URL set, and the third suspicious URL set.

[0009] This application uses clustering algorithms (such as K-means) to process the first and second types of features, and combines the isolation forest algorithm to detect anomalies in the third type of features, and comprehensively determines the risky URLs, thereby reducing the false positive rate and missed negative rate. By classifying and clustering behavioral features, the traditional code-level comprehensive scanning and real-time traffic monitoring are avoided, the system resource overhead is reduced, and the real-time performance of detection is improved.

[0010] Furthermore, the behavior attribute data of multiple dimensions of the URL include: attribute values ​​of the behavior attributes under the first dimension, and attribute values ​​of the behavior attributes under the second dimension; wherein the behavior attributes under the first dimension include at least one of the following: response packet status code, response packet Content-Type, request packet User-Agent, whether it is an internal request, whether it is a file download type request, whether the page response packet is encrypted, page access in-degree, page access out-degree, whether the page request packet is encrypted, page request parameters, page response packet content, static resource loading quantity and session access depth; the behavior attributes under the second dimension include at least one of the following: URL access IP quantity, URL request IP information entropy, URL page request packet mean, URL request packet variance, URL response packet mean, URL response packet variance, URL POST request ratio, URL average daily access times, URL page operation times, URL page access times, URL response packet standard deviation, URL User-Agent information entropy and URL request packet parameter variance.

[0011] Furthermore, the threshold conditions satisfied by the behavioral attribute data of the suspicious URL include at least one of the following: the number of static resource loads is equal to 0; the page access out-degree is equal to 0; the URL POST request ratio is greater than a preset first threshold; the URL response packet standard deviation is greater than a preset second threshold; the URL page request packet mean is greater than a preset third threshold; the URL response packet mean is greater than a preset fourth threshold.

[0012] Further, according to whether the risk URL meets the preset association matching condition, a Webshell detection result is generated, including: when the risk URL meets the association matching condition, a detection result indicating that the risk URL belongs to a Webshell is generated; when the risk URL does not meet the association matching condition, a detection result indicating that the risk URL belongs to a suspected Webshell is generated; wherein the risk URL meets the association matching condition including at least one of the following: the request packet of the risk URL contains ciphertext; the character length of the file name of the risk URL is less than a preset length, and / or the request response body contains preset content; the risk URL is associated with other security events existing in the host.

[0013] This application further verifies risky URLs by associating matching conditions to improve the accuracy of detection results.

[0014] Furthermore, obtaining a behavior data set includes: extracting multiple URLs and timestamps and behavior attribute data corresponding to each URL from a server access log; determining whether the behavior attribute data conforms to a preset Webshell access behavior; associating and saving the URLs that conform to the preset Webshell access behavior and their corresponding timestamps and behavior attribute data as behavior events; and generating a behavior data set based on the behavior events.

[0015] In a second aspect, an embodiment of the present invention provides a Webshell detection system, including: a behavior data set acquisition module, used to acquire a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions in multiple URLs, and the behavior attribute data of a normal URL and a risk URL in the same dimension are different; a suspicious URL determination module, used to determine, for each URL, whether the URL is a suspicious URL with suspicious behavior according to whether the behavior attribute data of the URL in multiple dimensions meets the corresponding threshold conditions; a behavior feature extraction module, used to extract the behavior features of each suspicious URL from the behavior data set; a risk URL determination module, used to screen out risk URLs that meet the Webshell features from multiple suspicious URLs according to the behavior features of multiple suspicious URLs; a detection result generation module, used to generate a Webshell detection result according to whether the risk URL meets a preset association matching condition.

[0016] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the method as described above.

[0017] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and the program code enables the processor to execute the method as described above.

[0018] The embodiment of the present invention provides a Webshell detection method, system and electronic device, including: obtaining a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions in multiple URLs, and the behavior attribute data of normal URLs and risky URLs in the same dimension are different; for each URL, determining whether the URL is a suspicious URL with suspicious behavior according to whether the behavior attribute data of the URL in multiple dimensions meets the corresponding threshold conditions; extracting the behavior characteristics of each suspicious URL from the behavior data set; screening out risky URLs that meet the Webshell characteristics from multiple suspicious URLs according to the behavior characteristics of multiple suspicious URLs; generating Webshell detection results according to whether the risky URLs meet the preset association matching conditions. In this method, by extracting and analyzing the behavior data of the URL, suspicious URLs that meet the Webshell behavior characteristics can be accurately identified, and Webshells can be further confirmed by screening abnormal patterns, thereby effectively reducing false positives and false negatives, thereby improving the accuracy of Webshell detection.

[0019] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention are realized and obtained by the structures particularly pointed out in the description, claims and drawings.

[0020] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A flow chart of the Webshell detection method provided in the embodiment of the present application;

[0023] Figure 2 A schematic diagram of a Webshell detection system provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0025] Icons: 1-behavior data set acquisition module; 2-suspicious URL determination module; 3-behavior feature extraction module; 4-risk URL determination module; 5-detection result generation module; 301-processor; 302-memory; 303-bus; 304-communication interface. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] In the prior art, there are two main Webshell detection methods: static analysis based on file content and detection based on traffic content.

[0028] Static analysis technology based on file content: Identifying Webshells through static analysis can check suspicious patterns, specific functions, and code structures in files; however, there are the following problems: (1) False positives: Static analysis cannot cope with the encryption or obfuscation technology of Webshells, and it is difficult to detect encrypted or obfuscated malicious code. (2) False positives: In normal business, certain specific requirements (such as batch file uploads) may lead to false positives because these business requirements also involve similar dangerous functions. (3) Performance overhead: When a large number of files need to be analyzed, system performance may be seriously degraded, especially in a hot-update middleware environment, where Webshells can lurk in existing files, further increasing the difficulty of detection. (4) Limitations: Only static files are analyzed, and Webshells running in memory or dynamically generated cannot be detected.

[0029] Traffic content-based detection technology: Analyze network traffic through deep packet inspection to detect the network activities of Webshell. However, there are the following problems: (1) Encrypted communication problem: Current Webshell communications are usually encrypted, which makes it impossible to detect attack behaviors through traffic analysis, especially when there is no key and the data packet cannot be decrypted. (2) Tunnel technology problem: Attackers may use tunnel technologies such as VPN (Virtual Private Network) and SSH (Secure Shell) to hide traffic, making it impossible for network monitoring devices to capture malicious traffic, resulting in missed reports. (3) Network delay problem: Real-time analysis of large amounts of traffic requires high-performance hardware, which may cause network delays and affect user experience. Especially in the real-time processing of large-scale traffic, it may affect the response speed of the system.

[0030] Therefore, the existing technology has significant defects in detection accuracy, performance overhead, concealment, etc., and it is difficult to effectively deal with the variability and complexity of Webshell.

[0031] The embodiment of the present invention provides a Webshell detection method, which can accurately identify suspicious URLs that meet the Webshell behavior characteristics, and further confirm the Webshell by screening abnormal patterns, thereby effectively reducing false positives and false negatives. Compared with the prior art, the present invention can detect Webshell more accurately, improve detection efficiency, reduce the impact on server performance, and adapt to Webshell variants and encrypted communications, effectively dealing with the complexity of malicious attacks.

[0032] To facilitate understanding of this embodiment, the embodiment of the present invention is described in detail below.

[0033] Embodiment 1:

[0034] Figure 1 A flow chart of the Webshell detection method provided in an embodiment of the present application.

[0035] Reference Figure 1 , the Webshell detection method includes the following steps S101-S105.

[0036] Step S101, obtaining a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions among multiple URLs, and the behavior attribute data of a normal URL and a risky URL in the same dimension are different.

[0037] Here, the behavior attribute under each dimension can be one or more. For each URL, the behavior attribute data of the URL under multiple dimensions are the attribute values ​​of multiple behavior attributes of the URL under multiple dimensions. The attribute values ​​of a normal URL and a risky URL under the same behavior attribute are different.

[0038] As an example, in step S101, the attribute values ​​of the behavior attributes of each URL in each dimension within a preset time period may be obtained.

[0039] In one embodiment, step S101 includes the following steps S201 - S204 .

[0040] Step S201: extract multiple URLs and timestamps and behavior attribute data corresponding to each URL from a server access log.

[0041] Here, the behavior attribute data of multiple dimensions of the URL includes: attribute values ​​of the behavior attributes under the first dimension, and attribute values ​​of the behavior attributes under the second dimension.

[0042] The behavioral attributes under the first dimension are basic behavioral attributes, which are derived from the direct attributes of a single request / response and are used to describe the basic behavior of the URL, such as access status, encryption, number of links, etc.

[0043] The behavioral attributes under the first dimension include at least one of the following:

[0044] Response package status code, response package Content-Type, request package User-Agent, whether it is an internal request, whether it is a file download request, whether the page response package is encrypted, page access in-degree, page access out-degree, whether the page request package is encrypted, page request parameters, page response package content, number of static resource loads and session access depth.

[0045] 1. Response packet status code:

[0046] Definition: HTTP (Hypertext Transfer Protocol) response status code, indicating the server's processing result of the request.

[0047] Examples: 200 (Success), 404 (Not Found), 500 (Server Error), etc.

[0048] Purpose: Determine whether the request is successful and the specific reason for failure.

[0049] 2. Response packet Content-Type (the type of response content, one of the HTTP response header fields):

[0050] Definition: Indicates the MIME (Multipurpose Internet Mail Extensions) type of the response content.

[0051] Examples: text / html, application / json, image / jpeg, etc.

[0052] 3. Request packet User-Agent (user agent information):

[0053] Definition: Identifies the type and version of the client that initiated the request.

[0054] Content: Contains information such as browser type and operating system.

[0055] 4. Is it an internal request?

[0056] Definition: Determine whether the HTTP request is a call between internal systems.

[0057] Characteristics: Usually identified by an IP address segment or a specific request header.

[0058] 5. Is it a file download request?

[0059] Definition: Determine whether the request involves a file download operation.

[0060] Characteristics: Determined by Content-Disposition (content processing method, one of the HTTP response header fields) header or URL characteristics.

[0061] 6. Is the page response package encrypted?

[0062] Definition: Whether the response content is encrypted.

[0063] Judgment: Identify through response header or content features.

[0064] 7. Page visit in-degree:

[0065] Definition: The number of links from other pages pointing to the current page.

[0066] Calculation: Count the number of other pages that reference the current page URL.

[0067] 8. Page visit out-degree:

[0068] Definition: The number of links from the current page to other pages.

[0069] Calculation: Count the number of external links in the page.

[0070] 9. Is the page request package encrypted?

[0071] Definition: Whether the request content is encrypted.

[0072] Judgment: Identify through request header or content features.

[0073] 10. Page request parameters:

[0074] Definition: The query string in the URL or the parameter in the POST (POST Request Body) request body.

[0075] Format: in the form of key-value pairs.

[0076] 11. Contents of page response package:

[0077] Definition: The actual content returned by the server.

[0078] Format: HTML, JSON, text, etc.

[0079] 12. Number of static resources loaded:

[0080] Definition: The number of static resources requested during page loading.

[0081] Contains: pictures, CSS, JavaScript and other files.

[0082] 13. Session access depth:

[0083] Definition: The number of page levels a user visits in the same session.

[0084] Calculation: Number of jumps from the entry page to the current page.

[0085] The behavioral attributes under the second dimension are statistically derived behavioral attributes, which are statistical features based on multiple visits and are used to describe the statistical laws of URL behavior, such as variance and information entropy.

[0086] The behavioral attributes under the second dimension include at least one of the following:

[0087] URL access IP number, URL request IP information entropy, URL page request package mean, URL request package variance, URL response package mean, URL response package variance, URL POST request ratio, URL daily average visits, URL page operation times, URL page visits, URL response package standard deviation, URL User-Agent information entropy and URL request package parameter variance.

[0088] 1. Number of URL access IPs:

[0089] Definition: How many different IP addresses access the same URL during the statistical period.

[0090] Calculation method: De-duplicate the number of independent IP addresses that access the URL.

[0091] 2. URL request IP information entropy:

[0092] Definition: A measure of the chaos of IP address distribution.

[0093] Calculation formula: H = -Σ(pi×log2pi);

[0094] Where: pi = number of visits from a certain IP address / total number of visits.

[0095] 3. Average value of URL page request packets:

[0096] Definition: The average size of all request packets.

[0097] Calculation formula: μ = Σ (request packet size) / total number of requests.

[0098] 4. URL request packet variance:

[0099] Definition: Measures the discreteness of request packet sizes.

[0100] Calculation formula: σ 2 =Σ(x-μ) 2 / n;

[0101] Where: x = single request packet size, μ = average request packet size, n = total number of requests.

[0102] 5. URL response packet average:

[0103] Definition: The average size of all response packets.

[0104] Calculation formula: μ = Σ (response packet size) / total number of responses.

[0105] 6. URL response packet variance:

[0106] Definition: The discreteness of the response packet size

[0107] Calculation formula: σ 2 =Σ(x-μ) 2 / n;

[0108] Where: x = single response packet size, μ = average response packet size, n = total number of responses.

[0109] 7. URL POST request ratio:

[0110] Definition: The proportion of POST method requests in the total requests.

[0111] Calculation formula: POST ratio = (number of POST requests / total number of requests) × 100%.

[0112] 8. Average number of URL visits per day:

[0113] Definition: The average number of visits per day.

[0114] Calculation formula: Average daily visits = total number of visits / number of statistical days.

[0115] 9. URL page operation times:

[0116] Definition: The number of interactions a user performs on a page.

[0117] Calculation method: Count the sum of all modification requests such as POST, PUT (Hypertext Transfer Protocol PUT), and DELETE (Hypertext Transfer Protocol DELETE).

[0118] 10. Number of URL page visits:

[0119] Definition: The total number of times the URL is visited during the statistical period.

[0120] Calculation method: Simply count all access requests.

[0121] 11. URL response packet standard deviation:

[0122] Definition: The discreteness of the response packet size.

[0123] Calculation formula: σ = √(Σ(x-μ)2 / n);

[0124] Where: x = single response packet size, μ = average response packet size, n = total number of responses.

[0125] 12. URL User-Agent information entropy:

[0126] Definition: Measures the diversity of accessing client types.

[0127] Calculation formula: H = -Σ(pi×log2pi);

[0128] Where: pi = number of occurrences of a User-Agent / total number of visits.

[0129] 13. URL request packet parameter variance:

[0130] Definition: The degree of discreteness of the number of request parameters.

[0131] Calculation formula: σ 2 =Σ(x-μ) 2 / n;

[0132] Where: x = number of parameters in a single request, μ = average number of parameters, n = total number of requests.

[0133] Furthermore, the server access log includes the request / response information recorded by the server, such as common fields such as URL, timestamp, request method, response status code, etc. The log file is parsed line by line to identify the URL and its corresponding timestamp.

[0134] Access log files within a period of time (for example, nearly one month) are obtained from the server for statistics. There are many ways to obtain access log files, such as configuring the server to send logs to Syslog (system log), configuring file sharing on the server, FTP (File Transfer Protocol) upload and download, SSH, Telnet (Remote Terminal Protocol) or other remote reading of log files.

[0135] Step S202, determining whether the behavior attribute data conforms to the preset Webshell access behavior.

[0136] Here, the preset Webshell access behavior defines the difference characteristics between Webshell and normal access.

[0137] Exemplarily, the preset Webshell access behaviors include:

[0138] The response package status code is 200 or 304, the request direction is an internal request, an update request for a non-specific application (wechat, qqpy_win, nvidia, etc.), a response package of a non-specific type (binary, audio, video, etc.), and a non-common file download request (PDF (Portable Document Format), PPT (PowerPoint, presentation), XLS (Excel, spreadsheet), etc.).

[0139] Step S203, the URLs that conform to the preset Webshell access behavior and the timestamps and behavior attribute data corresponding to each URL are associated and saved as behavior events.

[0140] Here, according to the Webshell status code characteristics, only events with response packet status codes equal to 200 or 304 are retained.

[0141] Since Webshell is a single-point trigger, a request needs to be initiated for each operation. Therefore, only internal requests are retained and external requests are filtered out.

[0142] Filter common application update requests, such as wechat, qqpy_win, nvidia, etc.

[0143] The Content-Type of the filter response packet is binary, audio, video, etc.

[0144] Filter common file download behaviors, such as PDF, PPT, XLS, etc.

[0145] Each request that meets the preset Webshell access behavior is regarded as a behavior event, and the behavior time includes the URL address, timestamp and behavior attribute data.

[0146] Step S204: Generate a behavior data set based on the behavior event.

[0147] Here, each behavior event is stored in a behavior data set. By creating a behavior data set, common behavior events that are not related to Webshell are initially filtered out.

[0148] Step S102: for each URL, whether the URL is a suspicious URL with suspicious behavior is determined based on whether the behavior attribute data of the URL in multiple dimensions meets corresponding threshold conditions.

[0149] In one embodiment, the threshold condition satisfied by the behavior attribute data of the suspicious URL includes at least one of the following:

[0150] The number of static resource loads is equal to 0; the page access out-degree is equal to 0; the URL POST request ratio is greater than the preset first threshold; the URL response packet standard deviation is greater than the preset second threshold; the URL page request packet mean is greater than the preset third threshold; the URL response packet mean is greater than the preset fourth threshold.

[0151] Specifically, the number of static resource loads is equal to 0:

[0152] Webshell usually exists in the form of scripts, with simple pages and almost no static resources loaded. The number of static resources loaded in the URL request is counted. If the number is 0, it is considered suspicious behavior. For example, when visiting a normal web page, multiple resources (such as 10 CSS files and pictures) are usually loaded, but the number of resources loaded on the Webshell page is 0.

[0153] The page access out-degree is equal to 0:

[0154] Webshell pages are usually isolated, with no links to other pages. The number of links in the page content is analyzed. If the number of links is 0, it is considered suspicious behavior. For example, normal web pages often have multiple navigation links, but Webshell pages do not have any links.

[0155] The URL POST request ratio is greater than the preset first threshold:

[0156] Webshell usually transmits commands and data through POST requests, and POST requests account for a very high proportion. Count the proportion of POST requests in all requests for a URL and compare it with the preset first threshold (pre-set according to actual conditions, which can be set to 70%). For example: if 90% of the requests for a certain URL are POST requests, it is judged to be suspicious.

[0157] The standard deviation of the URL response packet is greater than the preset second threshold:

[0158] The response content of the Webshell varies greatly because the commands and results of different requests are different. The standard deviation of the response packet size is calculated and compared with the preset second threshold (pre-set according to actual conditions, which can be set to 100KB). For example: the response packet size of an ordinary web page fluctuates less, while the response packet size of a Webshell may vary between 10KB and 500KB.

[0159] The average value of URL page request packets is greater than the preset third threshold:

[0160] Webshells usually need to pass complex commands or parameters through requests, so the request packet size is large. The average size of the request packet is calculated and compared with the preset third threshold (pre-set according to actual conditions, which can be set to 50KB). For example: the average size of a normal web page request packet is 20KB, while the average size of a request packet for a certain URL is 60KB.

[0161] The average value of URL response packets is greater than the preset fourth threshold:

[0162] The data responded by the webshell may contain the result of command execution, resulting in a larger average value of the response packet. The average value of the response packet size is calculated and compared with the preset fourth threshold (pre-set according to actual conditions, which can be set to 100KB). For example, the average value of the response packet of a normal web page is 50KB, while the average value of the response packet of a certain URL is 150KB.

[0163] It is determined that the URL whose behavior attribute data in the behavior data set meets the corresponding threshold condition is a suspicious URL.

[0164] Among them, if a URL meets multiple threshold conditions at the same time (such as the number of static resource loads is 0 and the page access out-degree is 0), its suspicion is further increased.

[0165] Step S103: extracting the behavior features of each suspicious URL from the behavior data set.

[0166] In one embodiment, the behavior characteristics of the URL include at least two of the following characteristics:

[0167] The first type of features includes the number of page visits and / or session visit depth of the user to the URL.

[0168] Here, the first type of feature is the access behavior feature, which mainly focuses on the user's access behavior. Because usually only hackers know the existence of Webshell, the number of page visits to Webshell is less than that of normal access pages, the number of visits is not frequent, and the Webshell page is usually visited directly, and the session access depth is also smaller than that of normal pages (usually 1).

[0169] Specifically, we traverse the log data and count the number of access requests for each URL. The number of visits to ordinary pages is 1,000 times per day, while the number of visits to suspicious Webshells is only 5 times per day.

[0170] According to the access track of the same session in the log, the number of jump levels to the current URL is counted. Ordinary pages are accessed by users through multi-level navigation (depth 3); Suspicious Webshell: directly access the page (depth 1).

[0171] The second type of features includes the number of resources loaded by the URL, the information entropy of the requesting IP address that requests to access the URL, and / or the number of accessing client types.

[0172] Here, the second type of feature is the resource diversity feature. From the perspective of diversity, the static resources loaded by the Webshell are 0. Since only hackers will actively connect to the Webshell, the source request packet is single in form, which is reflected in the small IP information entropy and User-Agent information entropy.

[0173] For example, the number of static resource requests in the log is analyzed, and a normal page loads 10 resources, while a suspicious Webshell loads 0 resources.

[0174] For example, when calculating the information entropy of a request IP, the information entropy of a normal page is 3.5, and the information entropy of a suspicious Webshell is 0.5.

[0175] We counted the types of different User-Agents and calculated their information entropy. The User-Agent information entropy of common pages is 3.2, and the User-Agent information entropy of suspicious Webshells is 0.8.

[0176] The third type of features includes the URL request packet parameter variance, response packet variance, and / or page operation times.

[0177] Here, the third type of feature is the abnormal behavior feature. In all operations of the Webshell, the operations to be executed are sent out through the POST request, and then the execution results are obtained through the response package. Since the operations executed each time are different, the final behavior is reflected in the relatively large variance of the URL request package parameters and the URL response package variance, and the number of page operations is also large.

[0178] For example, the variance of the request packet parameters of the URL is calculated, the variance of a normal page is 2, and the variance of a suspicious Webshell is 20.

[0179] For example, when calculating the variance of the response packet of a URL, the variance of a normal page is 5KB, while the variance of a suspicious Webshell is 50KB.

[0180] Analyze the number of interactive operations initiated by users recorded in the log. The number of operations on ordinary pages is 10, and the number of operations on suspicious Webshells is 100.

[0181] Step S104, based on the behavior characteristics of the multiple suspicious URLs, screen out risky URLs that meet the Webshell characteristics from the multiple suspicious URLs.

[0182] In one embodiment, step S104 includes the following steps S301 - S304 .

[0183] Step S301, when the behavior characteristics include first-category characteristics, cluster the first-category characteristics of multiple suspicious URLs, and determine suspicious URLs whose distance from the cluster center URL is less than a first preset distance from the multiple suspicious URLs to form a first suspicious URL set.

[0184] Here, the clustering processing method may be a K-means clustering algorithm.

[0185] According to the first type of features, suspicious URLs are divided into multiple clusters.

[0186] The number of page visits and session visit depth are used as input vectors (x1, x2), the number of clusters is set (such as 3 cluster centers), the distance between each suspicious URL and the cluster center is calculated, and the suspicious URLs whose distance from the cluster center is less than the first preset distance are classified into the first suspicious URL set.

[0187] Step S302, when the behavior characteristics include the second type of characteristics, clustering the second type of characteristics of multiple suspicious URLs, and determining suspicious URLs whose distance from the cluster center URL is less than a second preset distance from the multiple suspicious URLs to form a second suspicious URL set.

[0188] Here, the input vector is (number of resources, IP information entropy, User-Agent information entropy), the number of clusters is set (such as 3 cluster centers), the distance between each URL and the cluster center is calculated, and the suspicious URLs whose distance from the cluster center is less than the second preset distance are classified into the second suspicious URL set.

[0189] Step S303, when the behavior characteristics include the third type of characteristics, the third type of characteristics of multiple suspicious URLs are subjected to isolation forest processing to determine abnormal third type of characteristics, and a third suspicious URL set is formed for the suspicious URLs with abnormal third type of characteristics.

[0190] Here, the input vector is (parameter variance, response variance, number of operations), an isolation tree is constructed, and the isolation depth of each URL is calculated. URLs with a higher isolation depth are marked as abnormal and included in the third suspicious URL set.

[0191] Step S304: determine a risky URL that meets the Webshell feature according to the intersection of at least two of the first suspicious URL set, the second suspicious URL set, and the third suspicious URL set.

[0192] Exemplarily, the first suspicious URL set and the third suspicious URL set are intersected, and risk URLs that meet the Webshell characteristics are output based on the intersection result; or, the second suspicious URL set and the third suspicious URL set are intersected, and risk URLs that meet the Webshell characteristics are output based on the intersection result.

[0193] In another exemplary embodiment, the first suspicious URL set and the second suspicious URL set are intersected, and the intersection result is intersected with the third suspicious URL set to output risk URLs that meet the Webshell feature. The risk URLs that finally meet the Webshell feature are determined through the intersection of different features.

[0194] For example: when the first suspicious set includes: URL1, URL2, URL3, the second suspicious set includes: URL2, URL3, URL4, and the third suspicious set includes: URL3, URL5, the risky URL is URL3.

[0195] Step S105, generating a Webshell detection result according to whether the risky URL meets the preset association matching condition.

[0196] In one embodiment, step S105 includes the following steps S401 - S402 .

[0197] Step S401: When the risk URL meets the associated matching condition, a detection result indicating that the risk URL belongs to a Webshell is generated.

[0198] Step S402: When the risk URL does not meet the associated matching condition, a detection result indicating that the risk URL belongs to a suspected Webshell is generated.

[0199] The risk URL meets the associated matching condition including at least one of the following:

[0200] The request packet of the risky URL contains ciphertext; the character length of the file name of the risky URL is less than the preset length, and / or the request response body contains preset content; the risky URL is associated with other security events existing in the host.

[0201] Here, the risk URL meets the associated matching conditions as follows:

[0202] 1. The request packet of the risky URL contains ciphertext.

[0203] Determine whether the request package content is encrypted (for example, observe the call of specific fields in the request header or the decryption key). If the request package content is ciphertext and its content cannot be read directly, the risky URL meets the association matching condition.

[0204] 2. The character length of the file name of the risky URL is less than the preset length, and / or the request response body contains preset content.

[0205] Check whether the file name length of the risky URL is less than the preset value (for example, the file name is 1-3 characters, similar to a.php), and analyze whether the request response body contains hard-coded content or abnormal features (for example, containing a specific command string). Specifically, if the URL file name is "abc.php" and the response content contains "eval(base64_decode(...))", the risky URL meets the associated matching condition.

[0206] 3. The risky URL is associated with other security events present in the host.

[0207] Check whether the risky URL is associated with other abnormal behaviors on the host (such as high-frequency access, other unauthorized operations, etc.). Specifically, if there are a large number of abnormal login requests on the host and they are associated with the URL, the risky URL meets the association matching condition.

[0208] If the risky URL meets any associated matching conditions, it is marked as a Webshell, an alarm log is generated, recording the risky URL and the matching conditions it meets, and the URL is uploaded to the host computer or alarm system.

[0209] If the risky URL does not meet the association matching conditions but still has other abnormal features (such as third-party algorithm analysis and judgment), it will be marked as a suspected Webshell, a lower priority alarm log will be generated, and the URL will be uploaded to the host computer for further manual analysis.

[0210] The embodiment of the present invention provides a Webshell detection method, including: obtaining a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions in multiple URLs, and the behavior attribute data of normal URLs and risk URLs in the same dimension are different; for each URL, according to whether the behavior attribute data of the URL in multiple dimensions meet the corresponding threshold conditions, determine whether the URL is a suspicious URL with suspicious behavior; extract the behavior characteristics of each suspicious URL from the behavior data set; according to the behavior characteristics of multiple suspicious URLs, filter out risk URLs that meet the Webshell characteristics from multiple suspicious URLs; and generate Webshell detection results according to whether the risk URLs meet the preset association matching conditions. In this method, through multi-dimensional analysis of behavior data, dynamic threshold matching, multi-level algorithm screening (clustering and anomaly detection), and comprehensive association matching, the problems of insufficient accuracy, high false positives and false negatives, and high performance overhead in traditional Webshell detection are solved, and the performance, efficiency and adaptability of detection are significantly improved, providing a guarantee for server security.

[0211] In summary, the technical solution provided by the embodiment of the present invention analyzes HTTP access logs through statistical methods, finds out the difference characteristics between Webshell access behavior and normal access behavior, combines unsupervised algorithms, and various methods to reduce false alarms. Compared with other technologies, this solution has a higher detection rate and a lower false alarm rate for encrypted Webshells, does not require real-time monitoring of traffic and active scanning of local files, and does not reduce the user experience.

[0212] Embodiment 2:

[0213] Figure 2 Schematic diagram of the Webshell detection system provided in an embodiment of the present application.

[0214] Reference Figure 2 , the Webshell detection system includes:

[0215] The behavior data set acquisition module 1 is used to acquire the behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions among multiple URLs, and the behavior attribute data of normal URLs and risky URLs in the same dimension are different.

[0216] The suspicious URL determination module 2 is used to determine, for each URL, whether the URL is a suspicious URL with suspicious behavior according to whether the behavior attribute data of the URL in multiple dimensions meets the corresponding threshold conditions.

[0217] The behavior feature extraction module 3 is used to extract the behavior feature of each suspicious URL from the behavior data set.

[0218] The risk URL determination module 4 is used to screen out risk URLs that meet the Webshell characteristics from multiple suspicious URLs based on the behavioral characteristics of the multiple suspicious URLs.

[0219] The detection result generation module 5 is used to generate a Webshell detection result according to whether the risk URL meets the preset association matching condition.

[0220] In one embodiment, in the behavior feature extraction module 3, the behavior features of the URL include at least two of the following features:

[0221] The first type of features includes the number of page visits and / or session visit depth of the user to the URL.

[0222] The second type of features includes the number of resources loaded by the URL, the information entropy of the requesting IP address that requests to access the URL, and / or the number of accessing client types.

[0223] The third type of features includes the URL request packet parameter variance, response packet variance, and / or page operation times.

[0224] In one embodiment, the risk URL determination module 4 is further configured to:

[0225] When the behavior characteristics include first-category characteristics, the first-category characteristics of multiple suspicious URLs are clustered, and suspicious URLs whose distance from the cluster center URL is less than a first preset distance are determined from the multiple suspicious URLs to form a first suspicious URL set.

[0226] When the behavior characteristics include the second type of characteristics, the second type of characteristics of multiple suspicious URLs are clustered, and suspicious URLs whose distance from the cluster center URL is less than a second preset distance are determined from the multiple suspicious URLs to form a second suspicious URL set.

[0227] In the case where the behavior characteristics include the third type of characteristics, the third type of characteristics of multiple suspicious URLs are subjected to isolation forest processing to determine abnormal third type of characteristics, and a third suspicious URL set is formed for the suspicious URLs with abnormal third type characteristics.

[0228] According to the intersection of at least two of the first suspicious URL set, the second suspicious URL set, and the third suspicious URL set, a risky URL that meets the Webshell feature is determined.

[0229] In one embodiment, in the behavior data set acquisition module 1, the behavior attribute data of multiple dimensions of the URL includes: attribute values ​​of the behavior attributes under the first dimension, and attribute values ​​of the behavior attributes under the second dimension.

[0230] The behavioral attributes under the first dimension include at least one of the following:

[0231] Response packet status code, response packet Content-Type, request packet User-Agent, whether it is an internal request, whether it is a file download request, whether the page response packet is encrypted, page access in-degree, page access out-degree, whether the page request packet is encrypted, page request parameters, page response packet content, number of static resource loads and session access depth.

[0232] The behavioral attributes under the second dimension include at least one of the following:

[0233] URL access IP number, URL request IP information entropy, URL page request package mean, URL request package variance, URL response package mean, URL response package variance, URL POST request ratio, URL daily average visits, URL page operation times, URL page visits, URL response package standard deviation, URL User-Agent information entropy and URL request package parameter variance.

[0234] In one embodiment, in the suspicious URL determination module 2, the threshold conditions satisfied by the behavior attribute data of the suspicious URL include at least one of the following:

[0235] The number of static resource loads is equal to 0; the page access out-degree is equal to 0; the URL POST request ratio is greater than the preset first threshold; the URL response packet standard deviation is greater than the preset second threshold; the URL page request packet mean is greater than the preset third threshold; the URL response packet mean is greater than the preset fourth threshold.

[0236] In one embodiment, the detection result generating module 5 is further used for:

[0237] When the risky URL meets the associated matching condition, a detection result indicating that the risky URL belongs to a Webshell is generated.

[0238] When the risky URL does not meet the associated matching condition, a detection result indicating that the risky URL belongs to a suspected Webshell is generated.

[0239] The risk URL meets the associated matching condition including at least one of the following:

[0240] The request packet of the risky URL contains ciphertext; the character length of the file name of the risky URL is less than the preset length, and / or the request response body contains preset content; the risky URL is associated with other security events existing in the host.

[0241] In one embodiment, the behavior data set acquisition module 1 is further used for:

[0242] Extract multiple URLs and the timestamp and behavior attribute data corresponding to each URL from the server access log.

[0243] Determine whether the behavior attribute data conforms to the preset Webshell access behavior.

[0244] The URL that meets the preset Webshell access behavior and its corresponding timestamp and behavior attribute data are associated and saved as a behavior event.

[0245] Generate behavioral datasets based on behavioral events.

[0246] The embodiment of the present invention provides a Webshell detection system, which realizes the functional separation and efficient collaboration of the Webshell detection system through modular design, so that the system has high maintainability, scalability and adaptability, while improving the accuracy, efficiency and resource utilization of Webshell detection, providing a strong technical guarantee for server security.

[0247] The present application also provides an electronic device, such as Figure 3 As shown, it is a schematic diagram of the structure of the electronic device, wherein the electronic device includes a processor 301 and a memory 302, the memory 302 stores computer executable instructions that can be executed by the processor 301, and the processor 301 executes the computer executable instructions to implement the above-mentioned Webshell detection method.

[0248] exist Figure 3 In the illustrated embodiment, the electronic device further includes a bus 303 and a communication interface 304 , wherein the processor 301 , the communication interface 304 and the memory 302 are connected via the bus 303 .

[0249] Among them, the memory 302 may include a high-speed random access memory (RAM), and may also include a non-volatile memory (non-volatile memory), such as at least one disk storage. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 304 (which can be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. can be used. The bus 303 can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. The bus 303 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0250] The processor 301 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 301. The above processor 301 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor 301 reads the information in the memory and completes the steps of the Webshell detection method of the aforementioned embodiment in combination with its hardware.

[0251] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. The computer-readable medium stores a computer program, and when the computer program is run by a processor, the steps of the Webshell detection method of the above embodiment are executed.

[0252] The computer program product provided in the embodiment of the present invention includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment and will not be repeated here.

[0253] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system and device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0254] The embodiments or examples disclosed in this application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0255] In addition, in the description of the embodiments of the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0256] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0257] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0258] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A Webshell detection method, characterized in that: include: Acquire a behavior data set, wherein the behavior data set includes attribute values ​​of multiple behavior attributes of each URL in multiple dimensions, and the attribute values ​​of a normal URL and a risky URL under the same behavior attribute are different; For each of the URLs, determining whether the URL is a suspicious URL with suspicious behavior according to whether the attribute value of the behavior attribute of the URL meets the corresponding threshold condition; Extracting the behavior feature of each of the suspicious URLs from the behavior data set; According to the behavior characteristics of the plurality of suspicious URLs, screening out risky URLs that meet the Webshell characteristics from the plurality of suspicious URLs; A Webshell detection result is generated according to whether the risky URL meets the preset association matching condition.

2. The Webshell detection method according to claim 1, characterized in that: The behavior characteristics of the URL include the following characteristics: At least two of: The first type of features includes the number of page visits and / or session visit depth of the user to the URL; The second type of features includes the number of resources loaded by the URL, the information entropy of the requesting IP address that requests to access the URL, and / or the number of accessing client types; The third type of features includes the request packet parameter variance, response packet variance, and / or page operation times of the URL.

3. The Webshell detection method according to claim 1 or 2, characterized in that: According to the behavior characteristics of the plurality of suspicious URLs, risky URLs that meet the Webshell characteristics are screened out from the plurality of suspicious URLs, including: In the case where the behavior feature includes the first type of feature, clustering the first type of features of the plurality of suspicious URLs, and determining suspicious URLs whose distance from the cluster center URL is less than a first preset distance from the plurality of suspicious URLs to form a first suspicious URL set; In the case where the behavior feature includes the second type of feature, clustering the second type of features of the plurality of suspicious URLs, and determining suspicious URLs whose distance from the cluster center URL is less than a second preset distance from the plurality of suspicious URLs to form a second suspicious URL set; In the case where the behavior feature includes the third type of feature, performing isolation forest processing on the third type of features of the plurality of suspicious URLs, determining abnormal third type of features, and forming a third suspicious URL set for the suspicious URLs having the abnormal third type of features; Determine risky URLs that meet the Webshell feature according to an intersection of at least two of the first suspicious URL set, the second suspicious URL set, and the third suspicious URL set.

4. The Webshell detection method according to claim 1, characterized in that: The behavior attribute data of the multiple dimensions of the URL include: the attribute value of the behavior attribute under the first dimension, and the attribute value of the behavior attribute under the second dimension; wherein, The behavioral attributes under the first dimension include at least one of the following: Response packet status code, response packet Content-Type, request packet User-Agent, whether it is an internal request, whether it is a file download request, whether the page response packet is encrypted, page access in-degree, page access out-degree, whether the page request packet is encrypted, page request parameters, page response packet content, static resource loading quantity and session access depth; The behavioral attributes under the second dimension include at least one of the following: URL access IP number, URL request IP information entropy, URL page request package mean, URL request package variance, URL response package mean, URL response package variance, URL POST request ratio, URL daily average visits, URL page operation times, URL page visits, URL response package standard deviation, URL User-Agent information entropy and URL request package parameter variance.

5. The Webshell detection method according to claim 4, characterized in that: The threshold condition satisfied by the behavior attribute data of the suspicious URL includes at least one of the following: The static resource loading quantity is equal to 0; The page access out-degree is equal to 0; The URL POST request ratio is greater than a preset first threshold; The standard deviation of the URL response packet is greater than a preset second threshold; The URL page request packet average is greater than a preset third threshold; The URL response packet average is greater than a preset fourth threshold.

6. The Webshell detection method according to claim 1, characterized in that: Generate a Webshell detection result based on whether the risky URL meets the preset association matching condition, including: In the case where the risk URL satisfies the associated matching condition, generating a detection result indicating that the risk URL belongs to a Webshell; In the case that the risk URL does not satisfy the associated matching condition, generating a detection result indicating that the risk URL belongs to a suspected Webshell; The risk URL satisfies the associated matching condition, which includes at least one of the following: The request packet of the risky URL contains ciphertext; The character length of the file name of the risk URL is less than a preset length, and / or the request response body contains preset content; the risk URL is associated with other security events existing in the host.

7. The Webshell detection method according to claim 1, characterized in that: The step of obtaining a behavior data set includes: Extracting multiple URLs and timestamps and behavior attribute data corresponding to each URL from the server access log; Determining whether the behavior attribute data conforms to a preset Webshell access behavior; The URL that meets the preset Webshell access behavior and its corresponding timestamp and the behavior attribute data are associated and saved as a behavior event; A behavior data set is generated based on the behavior events.

8. A Webshell detection system, characterized in that: include: A behavior data set acquisition module, used to acquire a behavior data set, wherein the behavior data set includes behavior attribute data of each URL in multiple dimensions among multiple URLs, and the behavior attribute data of a normal URL and a risky URL in the same dimension are different; A suspicious URL determination module is used to determine, for each of the URLs, whether the URL is a suspicious URL with suspicious behavior according to whether the behavior attribute data of the URL in multiple dimensions meets corresponding threshold conditions; A behavior feature extraction module, used to extract the behavior feature of each of the suspicious URLs from the behavior data set; A risk URL determination module, used to screen out risk URLs that meet Webshell characteristics from the multiple suspicious URLs according to the behavior characteristics of the multiple suspicious URLs; The detection result generating module is used to generate a Webshell detection result according to whether the risky URL meets a preset association matching condition.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the Webshell detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the Webshell detection method according to any one of claims 1 to 7 is implemented.

Images