Establishment method and device of Bash command injection detection model and detection method and device of Bash command injection detection model

Abstract

The invention discloses establishment of a Bash command injection detection model and a detection method and device thereof, and the method comprises the steps: obtaining a training data set; feature data of each piece of sample data in the training data set is extracted, the feature data comprises first feature information of interference data in a character string of a Bash script in each piece of sample data, and the interference data is used for reducing the similarity between the character string of each Bash command in the Bash script and a preset reference character; wherein the reference character is a character string of the Bash command which is confirmed to have the injection risk; and a Bash command injection detection model is established by using the feature data, so that the detection model can identify and cope with a complex attack technique more effectively, the generalization ability and adaptability of the detection model are enhanced, and a more reliable guarantee is provided for network security.

Description

Technical Field

[0001] This document relates to network security technology, especially to the establishment of a Bash command injection detection model and its detection method and device. Background Art

[0002] Bash (Bourne Again SHell), a widely used command-line interpreter (shell), is mainly used to interact with Linux and Unix-like operating systems. Users input Bash commands through the terminal to perform various system operations, file management, program running and other tasks. However, in the field of network security, Bash command injection attacks pose a common threat. Attackers inject malicious commands and take advantage of system vulnerabilities to perform illegal operations, which may result in obtaining sensitive information or damaging the system.

[0003] Currently, the detection methods for Bash command injection attacks mainly include rule-based detection, syntax tree-based detection, neural network-based detection, and honeypot-based detection. Although these methods have their own advantages, there are still limitations, such as insufficient generalization ability, long detection time, poor model interpretability, or inability to effectively detect complex bypass techniques. Therefore, it is particularly urgent to develop a new Bash command injection detection scheme. Summary of the Invention

[0004] The embodiments of this application provide a method for establishing a Bash command injection detection model and its detection method and device.

[0005] A method for establishing a Bash command injection detection model includes:

[0006] Obtain a training data set;

[0007] Extract the feature data of each sample data in the training data set, where the feature data includes the first feature information of the interference data in the string of the Bash script in each sample data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0008] Use the feature data to establish a Bash command injection detection model.

[0009] A Bash command injection detection method includes:

[0010] Obtain target data carrying a Bash command;

[0011] Extract feature data from the target data, where the feature data of the target data includes first feature information of interference data in the string of the Bash script in the target data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0012] Input the feature data of the target data into a Bash command injection detection model to obtain a Bash command injection detection result, where the Bash command injection detection model is obtained by using the method described above.

[0013] An apparatus for establishing a Bash command injection detection model, comprising:

[0014] A first acquisition module, configured to acquire a training data set;

[0015] A first extraction module, configured to extract feature data of each sample data in the training data set, where the feature data includes first feature information of interference data in the string of the Bash script in each sample data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0016] A building module, configured to establish a Bash command injection detection model by using the feature data.

[0017] A Bash command injection detection apparatus, comprising:

[0018] A second acquisition module, configured to acquire target data carrying a Bash command;

[0019] A second extraction module, configured to extract feature data from the target data, where the feature data of the target data includes first feature information of interference data in the string of the Bash script in the target data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0020] A detection module, configured to input the feature data of the target data into a Bash command injection detection model to obtain a Bash command injection detection result, where the Bash command injection detection model is obtained by using the method described above.

[0021] A storage medium stores a computer program, wherein the computer program is configured to execute the method described above when running.

[0022] An electronic device includes a memory and a processor. The memory stores a computer program, and the processor is configured to run the computer program to execute the method described above.

[0023] In the embodiments of the present application, by obtaining training data and extracting the feature information of interference data in each sample data in the training data set to establish a detection model, complex attack methods can be more effectively identified and dealt with, the generalization ability and adaptability of the detection model are enhanced, and more reliable guarantee for network security is provided.

[0024] In addition, by obtaining target data carrying Bash commands and extracting the feature information of interference data in the target data for command injection detection, complex attack methods can be more effectively identified and dealt with, the generalization ability and adaptability of the detection model are enhanced, and more reliable guarantee for network security is provided.

[0025] Other features and advantages of the present application will be described in the following description, and some of them will become obvious from the description or be understood by implementing the present application. Other advantages of the present application can be realized and obtained through the solutions described in the description and the drawings. Description of the Drawings

[0026] The drawings are used to provide an understanding of the technical solutions of the present application, and constitute a part of the description. They are used together with the embodiments of the present application to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.

[0027] Figure 1 It is a schematic flowchart of the method for establishing a Bash command injection detection model provided by the embodiments of the present application;

[0028] Figure 2 It is a state transition diagram of the character state machine conversion process provided by the embodiments of the present application;

[0029] Figure 3 It is a schematic diagram of the syntax tree in the embodiments of the present application;

[0030] Figure 4 It is a schematic flowchart of the Bash command injection detection method provided by the embodiments of the present application;

[0031] Figure 5 It is a schematic structural diagram of the device for establishing a Bash command injection detection model provided by the embodiments of the present application;

[0032] Figure 6This is a schematic structural diagram of the Bash command injection detection device provided by the embodiments of the present application. Detailed implementation manners

[0033] The present application describes multiple embodiments, but the description is exemplary rather than restrictive, and it will be obvious to those of ordinary skill in the art that there can be more embodiments and implementation solutions within the scope covered by the embodiments described in the present application. Although many possible feature combinations are shown in the drawings and discussed in the detailed implementation manners, many other combination ways of the disclosed features are also possible. Unless specifically restricted, any feature or element of any embodiment can be combined with any other feature or element in any other embodiment, or can replace any other feature or element in any other embodiment.

[0034] The present application includes and contemplates combinations with features and elements known to those of ordinary skill in the art. The embodiments, features, and elements disclosed in the present application can also be combined with any conventional features or elements to form a unique invention solution. Any feature or element of any embodiment can also be combined with features or elements from other invention solutions to form another unique invention solution. Therefore, it should be understood that any feature shown and / or discussed in the present application can be implemented alone or in any appropriate combination. Therefore, except for the limitations made according to the appended claims and their equivalent replacements, the embodiments are not subject to other limitations. In addition, various modifications and changes can be made within the protection scope of the appended claims.

[0035] In addition, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not depend on the specific sequence of the steps described herein, the method or process should not be limited to the specific sequence of steps described. As will be understood by those of ordinary skill in the art, other step sequences are also possible. Therefore, the specific sequence of steps set forth in the specification should not be construed as a limitation on the claims. In addition, the claims directed to the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art can easily understand that these orders can be changed and still remain within the spirit and scope of the embodiments of the present application.

[0036] In the process of implementing the present application, the implementation manners and defects of the command injection detection method in the related art were analyzed:

[0037] Rule-based detection method:

[0038] Implementation method: Match known command injection patterns through a predefined rule set (such as regular expressions). This method relies on summarizing common attack patterns and directly detects commands that match the rules.

[0039] Defects: Poor generalization ability, unable to detect new types of attacks not covered by the rules; powerless against complex bypass techniques (such as variable substitution, command substitution), and easily bypassed by attackers.

[0040] Detection method based on syntax tree:

[0041] Implementation method: Use Bash syntax semantics to parse the string to be detected, generate a syntax tree, and detect potential command injection attacks by analyzing the syntax tree structure.

[0042] Defects: Prone to false negatives for attack forms that do not conform to the predefined syntax tree template; lack the ability to detect bypass techniques such as variable substitution and command substitution.

[0043] Detection method based on neural network:

[0044] Implementation method: Extract features of the command sequence through a neural network (such as CNN, LSTM), and combine the attention mechanism to weight the key features, so as to achieve attack detection.

[0045] Defects: Long model training time, high requirements for hardware resources, and difficult to meet real-time requirements; in addition, the feature interpretability is poor, it is difficult to directly obtain the attack pattern from the model, and it is easy to produce false positives and false negatives.

[0046] Detection method based on honeypot:

[0047] Implementation method: Execute the suspicious command in a virtual environment and judge whether it is an attack according to the execution result.

[0048] Defects: Unable to detect attacks on concatenated commands or unclosed quotes; the execution and judgment processes are time-consuming, and the detection efficiency is low.

[0049] Based on the above analysis, it can be seen that when detecting command injection attacks in the existing technology, there are problems such as insufficient generalization ability, long detection time, poor interpretability, and weak detection ability for complex bypass techniques. Therefore, a more efficient, accurate and highly generalized detection method is needed to cope with the increasingly complex attack means.

[0050] Based on the above analysis, the embodiments of the present application provide the following solutions:

[0051] Figure 1 It is a schematic flowchart of the method for establishing a Bash command injection detection model provided by the embodiments of the present application. As Figure 1 shown, the method includes:

[0052] Step 101: Obtain a training data set;

[0053] The sample data of the training data set includes known command injection attack samples (such as common attack patterns and bypass techniques) and normal command samples. The sources of the sample data can include public vulnerability databases, samples provided by security research institutions, logs in actual network traffic, etc. In addition, the sample data can be preprocessed, including cleaning invalid or duplicate data, converting the samples into a unified format (for example, extracting the command injection part in the HTTP request), and labeling the samples to distinguish normal commands and attack commands.

[0054] Step 102: Extract the feature data of each sample data in the training data set, where the feature data includes the first feature information of the interfering data in the string of the Bash script in each sample data.

[0055] Among them, the extracted feature data can be labeled according to the annotation of the sample data to form a vector with labels for use in building a model.

[0056] Among them, the interfering data refers to the complex bypass techniques or environmental diversity features deliberately introduced by the attacker to hide malicious commands and reduce their similarity to normal commands. The purpose of these interfering data is to reduce the similarity between the command string and the execution object string in the Bash script and the preset reference characters, where the reference characters are the strings of Bash commands that have been confirmed to have injection risks.

[0057] In this step, extracting the features of the interfering data has the following advantages, including:

[0058] Enhance the generalization ability of the detection model: Help the model learn the common bypass techniques of attackers and identify common deformation patterns in command injection attacks.

[0059] Improve the accuracy and reliability of detection: Provide richer context information, enabling the model to more accurately distinguish between normal commands and malicious commands.

[0060] Adapt to diverse attack scenarios: Help the model adapt to diverse attack scenarios and improve the flexibility and adaptability of detection.

[0061] Improve the interpretability of the detection model: Provide a clearer explanation for the detection results and help security personnel understand the intentions and techniques of attackers.

[0062] Step 103: Use the feature data to build a Bash command injection detection model.

[0063] By standardizing and normalizing the extracted feature data, constructing feature vectors, and selecting appropriate machine learning algorithms (such as XGBoost, SVM, or neural networks) for model training. Using the labeled training dataset, the model can learn the feature differences between normal commands and attack commands, thereby realizing the detection of Bash command injection attacks. The performance of the model is evaluated through the validation set, and the model parameters are optimized to improve the detection accuracy and generalization ability. Finally, the trained model is deployed to the detection system to detect command injection attacks in network traffic in real time, and the model is updated regularly according to the feedback of actual applications.

[0064] The method provided by the embodiment of this application can more effectively identify and respond to complex attack techniques, enhance the generalization ability and adaptability of the detection model, and provide more reliable guarantee for network security by obtaining a training dataset and extracting the feature information of interference data in each sample data in the training dataset to establish a detection model.

[0065] Taking the original string cat / etc / passwd as an example, there are two common distribution methods of interference data:

[0066] One is that the attacker covers up the true attack intention of Bash command injection through complex bypass techniques. Common deformations include:

[0067] 1. Variable substitution: a=c; b=a; c=t; d=c; $a$b$c / e$c$d / passwd.

[0068] 2. Command substitution, c`ab`at / etc / p``a`ec”ho s`swd

[0069] 3. Filling with meaningless strings, c\a\t" / "e"t"c" / "p"a"s"s"w"d"

[0070] 4. Filling with empty variables, c$1a$1t / e$5t$5c / p$5a$5s$5s$5w$5d

[0071] 5. Character reverse execution, `echo"dwssap / cte / tac"|rev`

[0072] 6. Wildcard matching execution, / b?n / c?t / e?? / p?sswd

[0073] 7. Character matching bypass, / b[i]n / c[a]t / e[a-z]c / pas[a-z]wd

[0074] 8. Character sequence generation bypass, c{a..z}t / e{a..t}c / passwd

[0075] Another way is that the attacker takes advantage of the context of Bash command execution, concatenates incorrect commands and malicious commands for execution, so as to achieve the purpose of hiding. Common variations include:

[0076] 1. Concatenation with &, 1&cat / etc / passwd&&

[0077] 2. Concatenation with |, 1|cat / etc / passwd||

[0078] 3. Concatenation with ;, 1;cat / etc / passwd;

[0079] 4. Command substitution, sdljfij`cat / etc / passwd`sdfdssfasdjpj

[0080] As can be seen from the above examples, the distribution methods of interfering data are diverse.

[0081] In the embodiments of the present application, the first feature information includes at least one of the following features:

[0082] 1. Whether there are consecutive quotation marks:

[0083] This feature is used to detect whether there are consecutive quotation marks (such as " or '). Such consecutive quotation marks may be a technique used by attackers to bypass detection. For example, by inserting meaningless quotation mark pairs to interfere with command parsing. Detecting this feature helps to identify possible bypass attempts.

[0084] 2. The ratio of the number of characters not in the Bash character set to the total number of characters:

[0085] This feature calculates the ratio of the number of characters in the string that do not belong to the Bash recognizable character set to the total number of characters. Bash recognizable characters usually include letters, numbers, common symbols, and command characters. If a string contains a large number of abnormal characters that do not belong to the Bash character set, this may indicate that the string is maliciously constructed, such as embedding pictures or other non-text content. This ratio can be used to determine whether the current environment is in an abnormal execution environment (such as a picture environment), thereby assisting in detecting command injection attacks.

[0086] 3. Whether there is a string identical to a preset dangerous command:

[0087] Dangerous commands refer to those Bash commands that can potentially threaten system security, stability, or data integrity. These commands usually have high permissions or can perform sensitive operations. Attackers may execute these commands through command injection attacks to obtain sensitive information, tamper with system configurations, or damage the system.

[0088] This feature is used to detect whether there is a string that is exactly the same as a preset dangerous command. For example, cat / etc / passwd is a common dangerous command, which an attacker may use directly or inject through deformation. By detecting strings that exactly match the preset dangerous commands, known high-risk command injection attacks can be quickly identified.

[0089] 4. Whether there is a string that is the same as a preset dangerous path:

[0090] Dangerous paths refer to those sensitive file or directory paths related to system security, such as / etc / passwd, / etc / shadow, / etc / hosts, etc. These paths usually contain system configuration information or user data, and attackers may try to access or tamper with these paths through command injection attacks.

[0091] This feature is used to detect whether there is a string that is the same as a preset dangerous path. For example, / etc / passwd is a common sensitive path, and an attacker may try to access or operate on this path. By detecting strings that match the preset dangerous paths, potential attacks on sensitive files or directories can be identified.

[0092] 5. The number of strings with the content "letter\letter":

[0093] This feature is used to detect whether there is a pattern like "letter\letter" in the string, such as c\a\t / e\tc / p\as\swd. This pattern is a common technique for attackers to bypass detection by inserting escape characters (\). Detecting this feature helps identify command injection attacks deformed by escape characters.

[0094] 6. Whether there is a set of strings that is the same as wildcards:

[0095] This feature is used to detect whether there is a set of strings that is the same as a wildcard pattern. For example, the command cat / etc / passwd can be deformed by wildcards into / b?n / c[a]t / e[t]c / p[a]s[s][a - z]d. This wildcard bypass technique utilizes the wildcard matching feature of Bash, making the attack command indistinguishable from normal commands in form. Detecting this feature can identify command injection attacks deformed by wildcards.

[0096] Based on the above description, these features analyze the structure and content of Bash command strings from different perspectives, aiming to identify common bypass techniques and dangerous patterns used by attackers. By detecting these features, the detection ability of command injection attacks can be effectively improved, especially for complex deformations and bypass techniques.

[0097] In the embodiments of the present application, the first feature information is obtained through processing by a character state machine. The character state machine traverses each character of the string to be detected and triggers state transitions according to the character type. The state transition process is as follows Figure 2 shown Figure 2 in the state transition diagram of the character state machine conversion process provided by the embodiments of the present application, specifically including:

[0098] 1. Initial state:

[0099] Receive the first character of the string to be detected and enter the character detection state (see arrow a in Figure 2 ).

[0100] 2. Character detection state:

[0101] Judge whether the current character is the last character of the string to be detected. If it is the last character, enter the termination state.

[0102] If it is not the last character, continue to judge whether the current character is the separator flag bit between the command and the execution object. If it is the separator flag bit, enter the command detection state (see arrow b in Figure 2 ).

[0103] If it is not the separator flag bit, continue to judge whether the current character belongs to the character set of the Bash command. If it belongs to the character set of the Bash command, continue to process the next character in the character detection state (see arrow e in Figure 2 ).

[0104] 3. Command detection state:

[0105] Starting from the position before the current separator flag bit, parse the characters one by one forward until a command separator appears, and extract the string between the current separator flag bit and the command separator as the current command string.

[0106] Judge whether the extracted command string is a preset dangerous command. If it is a dangerous command, enter the execution object detection state (see arrow c in Figure 2 ).

[0107] If it is not a dangerous command, return to the character detection state and continue to process the next character (see arrow f in Figure 2 ).

[0108] 4. Execution object detection state:

[0109] Starting from the position before the current separator flag bit, parse the characters one by one backward (see arrow h in Figure 2 ), until an end separator of the execution object or the last character of the string to be detected appears.

[0110] If the end delimiter of the execution object is parsed, extract the string between the current delimiter flag and the end delimiter of the execution object as the current execution object string, and return to the character detection state to continue processing the next character (see Figure 2 the arrow g) in

[0111] If it is the last character of the string to be detected, extract the string between the current delimiter flag and the last character of the string to be detected to obtain the current exception string, and enter the termination state (see Figure 2 the arrow g) in

[0112] 5. Termination state:

[0113] Output the feature information of the string to be detected.

[0114] By extracting features at these specific stages, the efficiency and accuracy of the detection logic can be ensured, while fully utilizing the dynamic parsing ability of the character state machine.

[0115] By extracting features at these specific stages, the efficiency and accuracy of the detection logic can be ensured, while fully utilizing the dynamic parsing ability of the character state machine.

[0116] In the embodiments of the present application, when the current command string, execution object string, or exception string is obtained, it is necessary to remove the interference data in each string. In the detection of Bash command injection, removing interference data is a key step for restoring the true intention of the command and improving the detection accuracy. The interference data includes variable substitution (such as $a$b), command substitution (such as `cat`), meaningless character filling (such as \)), wildcard matching (such as [a-z]), etc. These data will obscure the true intention of the command and increase the detection difficulty.

[0117] For example, restore the command string $c$a$t to cat, restore the execution object string / b?n / c[a]t to / bin / cat, and restore the exception string / e\tc / p\as\swd to / etc / passwd. By removing the interference data, the detection system can more clearly identify the true intention of the command, thereby more accurately determining whether there is a command injection attack. This method not only improves the detection accuracy but also enhances the generalization ability of the system, enabling it to cope with complex attack techniques.

[0118] Based on the above description, the extraction stage of each feature in the first feature information is closely related to the specific state of the character state machine:

[0119] Whether there is a string identical to the preset dangerous command: extracted in the command detection state.

[0120] Whether there is a string with the same preset dangerous path: extract it in the execution object detection state.

[0121] Whether there are consecutive quotation marks, the ratio of the number of characters not in the Bash character set to the total number of characters, the number of strings with the content of "letter\letter", and whether there is a set of strings identical to wildcards are detected in the character detection state, command detection state, and execution object detection state.

[0122] By dynamically detecting these features in each state, potential attack behaviors can be more comprehensively captured, thereby improving the overall performance and reliability of the command injection detection system.

[0123] In the embodiment of the present application, the character set of the Bash command only includes those characters directly involved in command parsing and execution (such as letters, numbers, path separators, etc.). There is a certain difference from the Bash character set, where the Bash character set may include all ASCII characters because they may be legal in certain contexts (such as comments or string content).

[0124] The separator flag between the command and the execution object is used to separate the command and its execution object (such as command parameters, file paths, etc.), or to separate multiple commands. Common separator flags include:

[0125] Space: The most basic separator, used to separate commands and arguments.

[0126] ${IFS} (Internal Field Separator): The internal field separator of Bash, used to define the default value of the field separator, usually including space, tab (\t), and newline (\n).

[0127] $IFS: The variable form of ${IFS}, which can be modified by the user or script to customize the field separator.

[0128] Pipe symbol (|): Used to take the output of one command as the input of another command.

[0129] Semicolon (;): Used to separate multiple commands, indicating the sequential execution of commands.

[0130] Logical operators (&&&, ||): Used for conditional execution of commands. && means to execute the latter command when the previous command is successful, and || means to execute the latter command when the previous command fails.

[0131] Based on the above symbols, the string of the command can be obtained, so as to determine whether the currently parsed command is a dangerous command. The end delimiter of the execution object is used to identify the end of the execution object (such as file path, command parameter, etc.). Common end delimiters of the execution object include:

[0132] Space: The most common delimiter, indicating the end of a parameter or execution object.

[0133] Semicolon (;): Indicates the end of a command and can also be used as an end delimiter of the execution object.

[0134] Pipe symbol (|): Indicates the end of the execution object and passes the output to the next command.

[0135] Logical operators (&&, ||): Indicate the end of the execution object and execute the next command according to the condition.

[0136] Newline character (\n): In a script or multi-line command, it indicates the end of the execution object or command.

[0137] Based on the above symbols, the string of the execution object can be obtained, so as to determine whether the currently parsed execution object is a dangerous path.

[0138] In the character detection state, when a character that does not belong to the Bash command character set is encountered, the system will adopt two processing strategies: skip the current character or re-enter the initial state. The purpose of this design is to effectively deal with the bypass techniques in command injection attacks while ensuring the flexibility and accuracy of the detection logic.

[0139] Skip the current character:

[0140] When it is detected that the current character does not belong to the Bash command character set, the system will skip this character and continue to process the next character. This strategy is applicable to the following scenarios:

[0141] Filling with meaningless characters: An attacker may insert meaningless characters (such as \, space, etc.) into the command to interfere with the detection. By skipping these characters, the system can ignore these interferences and continue to detect the subsequent valid characters.

[0142] Wildcard bypass: An attacker may use wildcards (such as *,?) to bypass the detection. Skipping these characters can avoid misjudgment caused by wildcards and continue to detect possible dangerous commands in the future.

[0143] Re-enter the initial state:

[0144] Another strategy is to re-enter the initial state and start the character detection state again with the next character. This strategy is applicable to the following scenarios:

[0145] Complex bypass techniques: Attackers may hide their true intentions through complex character combinations (such as variable substitution, command substitution). Re-entering the initial state can re-initialize the detection logic and avoid logical confusion caused by the current characters.

[0146] Nested commands: In some cases, attackers may nest multiple commands. By re-entering the initial state, the system can re-parse subsequent commands to ensure the integrity of the detection logic.

[0147] For the above two processing methods, in the character state machine, when encountering characters that do not belong to the Bash command character set, the system needs to make a decision:

[0148] If the character is an obvious interference character (such as a meaningless escape character), skipping the character can avoid misjudgment and continue to detect subsequent characters.

[0149] If the character may be the start of a complex bypass technique (such as the $ in variable substitution), re-entering the initial state can re-initialize the detection logic to ensure the correct parsing of subsequent characters.

[0150] The above implementation method not only improves the flexibility of the detection system but also enhances its ability to handle complex bypass techniques. By skipping meaningless characters or re-initializing the detection logic, the system can more accurately identify potential command injection attacks, thereby improving the accuracy and reliability of detection.

[0151] Based on the above description, the character state machine traverses the characters in the string one by one, identifies and skips common bypass techniques (such as quotes and $ variable substitution), combines the characters into a meaningful whole, and then determines whether there are high-risk commands or paths. Compared with traditional regular expressions, the advantage of the character state machine is that it can systematically identify and prevent bypasses based on meaningless characters.

[0152] For example, for the command cat / etc / passwd, attackers may deform it into c`$IFS`""a``""t / e”t""”c / p”a""s`$IFS`s``w``d by inserting $IFS, empty quotes, or other bypass techniques. This deformation makes it difficult for traditional regular expressions to match because a regular expression that can be compatible with all bypass forms is not only extremely complex but also has poor readability, making it difficult for even professionals to implement. The character state machine can flexibly handle various bypass techniques through dynamic parsing, and record the number of bypass techniques as a feature, thereby improving the accuracy and efficiency of detection.

[0153] During the entire detection process, the character state machine can not only eliminate the bypass interference in the command string, but also record the characteristics of the bypass techniques, providing richer information for the subsequent machine learning model and further enhancing the detection ability.

[0154] In addition, the feature data extracted in the embodiments of the present application includes not only the interference data features based on the character state machine (i.e., the first feature information), but also the feature information based on the Bash syntax tree (i.e., the second feature information). This analytical method that combines the whole and the part has significant advantages and can more comprehensively identify and detect potential command injection attacks.

[0155] The syntax tree is a tree-like structure generated through the syntactic and semantic analysis of Bash scripts. It reflects the logical structure and syntax rules of commands and provides the global structure information of commands. By combining the global perspective of the syntax tree with the local detail perspective of the character state machine, Bash scripts can be comprehensively analyzed from both the overall and local dimensions. It has the following advantages:

[0156] Improve detection accuracy: The syntax tree provides global structure information, and the character state machine provides local detail information. The combination of the two can more accurately identify potential attack behaviors and reduce false positives and false negatives.

[0157] Enhance generalization ability: The syntax tree can identify the overall structure of commands, and the character state machine can identify specific bypass techniques. This combination method can better adapt to diverse attack scenarios.

[0158] Improve detection efficiency: By quickly locating dangerous commands through the syntax tree and combining the character state machine to deeply analyze the details, the detection efficiency can be improved while ensuring the detection accuracy.

[0159] Enhance interpretability: By combining the feature information of the syntax tree and the character state machine, the detection results can be more clearly explained, helping security personnel understand the intent and techniques of attacks.

[0160] Among them, establishing a Bash command injection detection model using the feature data includes:

[0161] Concatenate the first feature information and the second feature information to obtain the concatenated feature information;

[0162] Use the concatenated feature information to establish a Bash command injection detection model.

[0163] In the above implementation, splicing the first feature information and the second feature information mainly aims to: reduce false positives and false negatives through the combination of global features and local features, improve the accuracy and comprehensiveness of detection; enhance the generalization ability of the model so that it can better adapt to diverse attack scenarios; provide richer information for machine learning model training and improve the performance of the model; improve the interpretability of detection to facilitate developers to understand and optimize the model.

[0164] In the embodiment of the present application, the second feature information includes at least one of the following features:

[0165] 1. Whether there are unclosed quotation marks:

[0166] Detect whether there are unpaired closing quotation marks (single quotation mark'or double quotation mark ") in the string. Such quotation marks may be deliberately inserted by the attacker to interfere with command parsing or bypass the detection logic based on quotation mark separation. For example, the missing closing quotation mark in the command cat'file may cause command parsing errors or be used by the attacker to embed additional commands. Detecting this feature helps identify potential bypass attempts.

[0167] 2. Whether there is the $IFS or ${IFS} symbol:

[0168] Detect whether there is the $IFS or ${IFS} symbol in the string. IFS (Internal Field Separator) is a variable used to define field separators in Bash. Attackers may use $IFS or ${IFS} to replace spaces, thereby bypassing the detection logic based on space separation. For example, cat${IFS} / etc / passwd may be parsed as cat / etc / passwd. Detecting this feature can effectively identify such bypass attempts.

[0169] 3. Whether there is a variable assignment behavior:

[0170] Detect whether there is a variable assignment behavior in the string (such as a=cat). Attackers may split dangerous commands into multiple parts through variable assignment to hide their true intentions. For example, a=cat; b= / etc / passwd; $a$b. Detecting variable assignment behavior helps identify such potential attack techniques.

[0171] 4. Whether there is a variable substitution form:

[0172] Detect whether there is a variable substitution form in the string (such as ${HOME:1:3}). Variable substitution is a feature in Bash. Attackers may use it to hide a part of the command, thereby bypassing detection. For example, ${HOME:1:3} may be replaced with cat. Detecting variable substitution forms can effectively identify such bypass techniques.

[0173] 5. Whether it conforms to Bash syntax:

[0174] Detect whether the string conforms to the basic syntax of Bash. The generation of the syntax tree depends on the legality of the command. If the string does not conform to the Bash syntax, a valid syntax tree cannot be generated. Detecting syntax errors can quickly rule out obviously illegal commands and reduce false positives.

[0175] 6. Whether there is a $ symbol:

[0176] Detect whether there is a $ symbol in the string. The $ symbol is used for variable reference and command substitution in Bash, and attackers may use it to hide the true intention of the command. For example, $a$b may be replaced with cat / etc / passwd. Detecting the presence of the $ symbol helps identify potential variable substitution or command substitution behaviors.

[0177] 7. Whether there is a behavior of using variables after assignment:

[0178] Detect whether there is a behavior of re - calling an assigned variable in the string (such as a=cat; b= / etc / passwd; $a$b). Attackers may hide dangerous commands through variable concatenation, making them difficult to be directly detected. Detecting the usage behavior of variables helps identify this potential attack method.

[0179] By detecting these features, the Bash command string can be analyzed from multiple perspectives to identify potential command injection attacks and improve the accuracy and reliability of detection.

[0180] Figure 3 This is a schematic diagram of the syntax tree in the embodiments of this application. This figure illustrates the parsing process of a complex Bash command c$(echo a)t$(echo / etc*) / s$(echo had)ow, which is decomposed into different command objects (cmd_object). The construction of this syntax tree helps extract and analyze the features in the command for command injection detection.

[0181] In Figure 3 the syntax tree shown:

[0182] The root node is marked as cmd_tree, representing the syntax structure of the entire command, which is the starting point of command parsing.

[0183] The first - layer child nodes are divided into cmd_object1 and cmd_object2, representing the two main command objects in the command. Each command object may contain one or more sub - commands or parameters.

[0184] The second-level child nodes of cmd_object1 include c, ${echo a}, and t, indicating that the object contains the command c and the strings ${echo a} and t generated through variable substitution and command substitution. These child nodes reveal possible bypass techniques in the command.

[0185] The second-level child nodes of cmd_object2 include ${echo / etc*}, / s, ${echo had}, and ${echohad}, indicating that the object contains the strings ${echo / etc*} and ${echo had} generated through command substitution, as well as the string / s. These child nodes also show possible bypass techniques in the command.

[0186] Figure 3 By showing the syntax tree of the command c$(echo a)t$(echo / etc*) / s$(echo had)ow, it illustrates how to decompose complex Bash commands into smaller command objects and further analyze these objects to extract features related to command injection, thereby improving the accuracy and reliability of command injection detection.

[0187] Figure 4 It is a schematic flowchart of the Bash command injection detection method provided by the embodiment of this application. As Figure 4 shown, the method includes:

[0188] Step 401, obtain target data carrying a Bash command;

[0189] The target data can be an HTTP request, a system call, a script execution record, etc., which may contain Bash commands attempted to be injected by an attacker. The specific operations include reading data packets from the network card of the detection device, parsing them into HTTP messages or other relevant formats; identifying and extracting parts that may contain Bash commands, such as URL parameters, form data, command-line inputs, etc.; decoding and formatting the extracted data to convert it into a readable text format; extracting corresponding attack features for the detection points, such as command structure, parameters, environment variables, etc.

[0190] Step 402, extract feature data from the target data, where the feature data of the target data includes the first feature information of the interfering data in the string of the Bash script in the target data, and the interfering data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0191] By identifying interfering data, the detection model can more accurately distinguish normal commands from potential injection attacks, thereby reducing false positives and false negatives; the extracted feature information makes the model more robust to various bypass techniques and can maintain efficient detection even when facing complex or unknown attack methods; the introduction of interfering data features enhances the generalization ability of the model to unseen attack patterns, enabling it to adapt to the changing threat environment. In summary, step 402 provides key data support for Bash command injection detection by extracting the feature information of interfering data, significantly improving the accuracy and reliability of the detection system.

[0192] Step 403: Input the feature data of the target data into the Bash command injection detection model to obtain the Bash command injection detection result, where the Bash command injection detection model is obtained by the method described above.

[0193] The extracted feature vectors are input into the trained detection model, and this detection module can be established based on the XGBoost algorithm or other machine learning algorithms. The detection model determines whether the target data contains a Bash command injection attack based on the input feature data and outputs a detection result indicating whether there is a Bash command injection attack. Among them, the inspection result can be binary (such as "safe" or "attack"), or it can be more detailed information including a risk score or probability.

[0194] The method provided by the embodiments of the present application can more effectively identify and respond to complex attack techniques, enhance the generalization ability and adaptability of the detection model, and provide more reliable protection for network security by obtaining target data carrying Bash commands and extracting the feature information of interfering data in the target data for command injection detection.

[0195] Figure 5 This is a schematic structural diagram of a device for establishing a Bash command injection detection model provided by the embodiments of the present application. As Figure 5 shown, the device includes:

[0196] The first acquisition module 501 is configured to acquire a training data set;

[0197] The first extraction module 502 is configured to extract the feature data of each sample data in the training data set, where the feature data includes the first feature information of interfering data in the string of the Bash script in each sample data, and the interfering data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0198] A building module 503 is configured to build a Bash command injection detection model by using the feature data.

[0199] The device provided by the embodiment of the present application can, by obtaining a training data set and extracting the feature information of interference data in each sample data in the training data set to build a detection model, more effectively identify and cope with complex attack methods, enhance the generalization ability and adaptability of the detection model, and provide more reliable guarantee for network security.

[0200] Figure 6 It is a structural schematic diagram of the Bash command injection detection device provided by the embodiment of the present application. As Figure 6 shown, the device includes:

[0201] A second acquisition module 601 is configured to acquire target data carrying a Bash command;

[0202] A second extraction module 602 is configured to extract feature data from the target data, where the feature data of the target data includes the first feature information of interference data in the string of the Bash script in the target data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk;

[0203] A detection module 603 is configured to input the feature data of the target data into a Bash command injection detection model to obtain a Bash command injection detection result, where the Bash command injection detection model is obtained by using the method described above.

[0204] The device provided by the embodiment of the present application can, by obtaining target data carrying a Bash command and extracting the feature information of interference data in the target data to perform command injection detection, more effectively identify and cope with complex attack methods, enhance the generalization ability and adaptability of the detection model, and provide more reliable guarantee for network security.

[0205] The embodiment of the present application further provides a storage medium, in which a computer program is stored, and the computer program is configured to execute the method described above when running.

[0206] The embodiment of the present application further provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the method described above.

[0207] The solution provided by the implementation of this application can be applied to network security products such as WAAP (Web Application and API Protection), WAF (Web Application Firewall), and IDPS (Intrusion Detection and Prevention System), improving the technical competitiveness of such products.

[0208] Those of ordinary skill in the art will understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations. In the hardware implementation, the division of the functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component can have multiple functions, or a function or step can be executed by several physical components in cooperation. Some or all components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cassette, tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, as is well known to those of ordinary skill in the art, a communication medium typically contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium.

Claims

1. A method for establishing a Bash command injection detection model, comprising: Obtaining a training data set; Extracting the feature data of each sample data in the training data set, where the feature data includes the first feature information of the interference data in the string of the Bash script in each sample data, and the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk; Establishing a Bash command injection detection model using the feature data.

2. The method according to claim 1, characterized in that, The first feature information includes at least one of the following: Whether there are consecutive quotation marks; the ratio of the number of characters not in the Bash character set to the total number of characters; whether there is a string identical to a preset dangerous command; whether there is a string identical to a preset dangerous path; the number of strings with the content of "letter\letter"; Whether there is a string set identical to a wildcard.

3. The method according to claim 1 or 2, characterized in that The acquisition method of the first feature information is as follows: Traverse each character of the string to be detected, and trigger state transitions according to the character type, where the state transition process includes: In the initial state, receive the first character of the string to be detected and enter the character detection state; In the character detection state, determine whether the current character is the last character of the string to be detected. If it is the last character, enter the termination state; if it is not the last character, continue to determine whether the current character is the delimiter between the command and the execution object. If it is the delimiter, enter the command detection state; if it is not the delimiter, continue to determine whether the current character belongs to the character set of the Bash command. If it belongs to the character set of the Bash command, continue to process the next character in the character detection state; In the command detection state, start parsing characters one by one forward from the position before the current delimiter until a command delimiter appears, and extract the string between the current delimiter and the command delimiter as the current command string. Determine whether the extracted command string is a preset dangerous command. If it is a dangerous command, enter the execution object detection state; if it is not a dangerous command, return to the character detection state and continue to process the next character; In the execution object detection state, start parsing characters one by one backward from the position before the current delimiter until the end delimiter of the execution object or the last character of the string to be detected appears. If the end delimiter of the execution object is parsed, extract the string between the current delimiter and the end delimiter of the execution object as the current execution object string, and return to the character detection state to continue processing the next character; if it is the last character of the string to be detected, that is, extract the string between the current delimiter and the last character of the string to be detected to obtain the current abnormal string, and enter the termination state; In the termination state, output the feature information of the string to be detected.

4. The method according to claim 3, characterized in that, The method further includes: In the character detection state, if the current character does not belong to the character set of the Bash command, skip the current character and continue to process the next character; or, re-enter the initial state and start again from the next character to enter the character detection state again.

5. The method according to claim 3, characterized in that, The method further includes: When obtaining the current command string, the current execution object string, or the current exception string, remove the interference data in each string.

6. The method according to claim 1, wherein: The feature data further includes second feature information of the syntax tree of the Bash script in each sample data; Wherein, the establishing the Bash command injection detection model by using the feature data includes: Concatenating the first feature information and the second feature information to obtain the concatenated feature information; Using the concatenated feature information to establish a Bash command injection detection model.

7. The method according to claim 6, wherein The second feature information includes at least one of the following: Whether there is an unclosed quotation mark; whether there is a \$IFS or \${IFS} symbol; whether there is a variable assignment behavior; Whether there is a variable substitution form; Whether it conforms to the Bash syntax; whether there is a \$ symbol; whether there is a behavior of using a variable after assignment.

8. A Bash command injection detection method, including: Obtaining target data carrying a Bash command; Extracting feature data from the target data, where the feature data of the target data includes first feature information of interference data in the string of the Bash script in the target data, where the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk; Inputting the feature data of the target data into a Bash command injection detection model to obtain a Bash command injection detection result, where the Bash command injection detection model is obtained by using the method according to any one of claims 1 to 7.

9. A device for establishing a Bash command injection detection model, including: A first acquisition module configured to acquire a training data set; A first extraction module configured to extract the feature data of each sample data in the training data set, where the feature data includes first feature information of interference data in the string of the Bash script in each sample data, where the interference data is used to reduce the similarity between the string of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk; A building module configured to establish a Bash command injection detection model by using the feature data.

10. A Bash command injection detection device, including: A second acquisition module configured to acquire target data carrying a Bash command; A second extraction module, configured to extract feature data from the target data, wherein the feature data of the target data includes first feature information of interference data in the strings of Bash scripts in the target data, and the interference data is used to reduce the similarity between the strings of each Bash command in the Bash script and a preset reference character, and the reference character is the string of a Bash command that has been confirmed to have an injection risk; A detection module, configured to input the feature data of the target data into a Bash command injection detection model to obtain a Bash command injection detection result, wherein the Bash command injection detection model is obtained by using the method described in any one of claims 1 to 7.

11. A storage medium, characterized in that, A computer program is stored in the storage medium, wherein the computer program is configured to execute the method described in any one of claims 1 to 8 when running.

12. An electronic device, comprising a memory and a processor, characterized in that, A computer program is stored in the memory, and the processor is configured to run the computer program to execute the method described in any one of claims 1 to 8.

Images