Webshell script static detection method and device

Abstract

The invention provides a static detection method and device for a Webshell script. The method comprises the steps of obtaining webpage traffic received by a target Web application; decoding the webpage traffic to obtain a readable character string; extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features and keyword features of the readable character string; the feature vectors are input into a Webshell static detection model, a detection result output by the Webshell static detection model is obtained, and the Webshell static detection model is obtained based on feature vector training corresponding to subjective features, objective features, combined features, symbol features and keyword features of readable Webshell samples and normal samples; and determining whether the webpage traffic is a Webshell script or not according to a detection result. By adopting one model, webpage traffic detection of various programming languages can be realized, and the accuracy and efficiency of Webshell script static detection are improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a static detection method for a Webshell script, a static detection device for a Webshell script, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the rapid development of computer network technology, World Wide Web (Web) applications have become widely used. Attackers often use Web applications to attack the servers behind them. One attack method involves implanting backdoor files in the server. A backdoor file is a malicious program or script that attackers insert into a server after successfully compromising it. Using this backdoor file, attackers can bypass the server's normal security authentication mechanisms, gaining covert and persistent access, stealing data from the server, and tampering with it.

[0003] Webshell scripts are a common backdoor file currently. Webshell script detection mainly includes static detection and dynamic detection. In the static detection of Webshell scripts, it is mainly based on regular matching and machine learning. The machine learning method is more widely used because of its higher detection accuracy. The Webshell static detection method based on machine learning needs to first substitute the Webshell script and normal web page files into the machine learning model for training to obtain a trained model. When a Webshell static detection is required for a Web application, the web page traffic of the Web application is obtained, and the obtained web page traffic is input into the trained model. The trained model processes the web page traffic, generates and outputs the detection result of whether the web page traffic is a Webshell script. Based on the output result of the model, it is possible to determine whether the web page traffic is a Webshell script, thereby realizing static detection of Webshell in Web applications.

[0004] However, Webshell scripts can be written in a variety of languages, such as PHP, ASP, ASPX, JSP, and JSPX. Because the characteristics of the same Webshell script written in different languages ​​vary, separate model training is required for each language. Consequently, a trained model can only statically detect Webshell scripts written in one language. Since it's impossible to predict which language an attacker will use to launch an attack, models corresponding to various languages ​​must be used simultaneously to detect the same webpage traffic from a web application. Using multiple models to detect a single webpage traffic consumes significant resources and reduces detection efficiency. Furthermore, during model training, it's impossible to list all the languages ​​involved in Webshell scripts, making it impossible to train detection models for each language. This makes Webshell scripts written in some languages ​​undetectable, further reducing the accuracy of static Webshell script detection. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a static detection method for Webshell scripts, a static detection device for Webshell scripts, a computer device, a computer-readable storage medium, and a computer program product to improve the accuracy and efficiency of static detection of Webshell scripts.

[0006] To solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0007] In a first aspect, the present application provides a static detection method for Webshell scripts, the method comprising: obtaining web page traffic received by a target Web application; decoding the web page traffic to obtain a readable character string; extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of the readable character string, wherein the subjective features are command features of known Webshell scripts, the objective features are character statistical features of the readable character string, the combined features are combinations of command features of known Webshell scripts, the symbol features are special characters, and the keyword features are keywords related to the Webshell script; inputting the feature vectors into a Webshell static detection model to obtain a detection result output by the Webshell static detection model, wherein the Webshell static detection model is trained based on feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of readable Webshell samples and normal samples; and determining whether the web page traffic is a Webshell script based on the detection result.

[0008] Compared with the prior art, the static detection method of Webshell scripts provided in the first aspect of the present application uses readable Webshell samples and normal samples in the training of the Webshell static detection model, which can overcome the differences between training samples of different programming languages, so that training samples of various programming languages ​​can be trained in the same model. In addition, by using the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features of Webshell samples and normal samples, more streamlined training samples can be obtained in model training. The trained model can accurately and efficiently detect web page traffic in different programming languages. The web page traffic to be detected is first processed into a readable string, and then the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features are extracted, and then input into the model for detection. Using one model, web page traffic detection in various programming languages ​​can be achieved, improving the accuracy and efficiency of static detection of Webshell scripts.

[0009] In other embodiments provided in the present application, before extracting feature vectors corresponding to the subjective features, objective features, combined features, symbol features, and keyword features of the readable character string, the method further includes: performing at least one of variable-length encoding, string splitting, and generalization on the readable character string to obtain a standard character string; extracting feature vectors corresponding to the subjective features, objective features, combined features, symbol features, and keyword features of the readable character string, including: extracting feature vectors corresponding to the subjective features, objective features, combined features, symbol features, and keyword features of the standard character string.

[0010] First, variable-length encoding, string splitting and generalization operations are performed on the readable string to further improve the readability of the string, improve the accuracy of subsequent feature extraction, and thus improve the accuracy of Webshell script detection.

[0011] In other implementations provided in the present application, decoding the web page traffic to obtain a readable character string includes: performing multiple decoding processes on the web page traffic in sequence to obtain a readable character string.

[0012] Multiple decoding processes are performed on web traffic in sequence. Even web traffic that is deliberately encoded in multiple languages ​​can be successfully decoded, improving the accuracy of web traffic decoding. This allows the model to process fully decoded content and improves the accuracy of Webshell script detection.

[0013] In other embodiments provided in the present application, multiple decoding processes are sequentially performed on web page traffic to obtain a readable string, including: after performing one of multiple encoding processes on the web page traffic, if all characters in the web page traffic are converted, a readable string is obtained.

[0014] In the processing of multiple decodings of web page traffic, once a certain decoding method is used to process the web page traffic, all characters in the web page traffic are processed, indicating that the web page traffic has been completely decoded and there is no need to continue to use the remaining decoding methods to process the web page traffic. While ensuring that the web page traffic is fully decoded, the number of decoding processes for the web page traffic is reduced, thereby improving the decoding efficiency of the web page traffic.

[0015] In other embodiments provided in the present application, before decoding the web page traffic to obtain a readable string, the method further includes: if the web page traffic contains any script language among php, asp, aspx, jsp and jspx, then executing the step of decoding the web page traffic to obtain a readable string; if the web page traffic does not contain any script language among php, asp, aspx, jsp and jspx, then ending the detection.

[0016] Since Webshells are usually edited in PHP, ASP, ASPX, JSP, and JSPX languages, we first determine whether the webpage traffic uses these languages. If we determine that these languages ​​are not used, we end the detection directly. This ensures that the detection accuracy is not significantly reduced, and the amount of data that can be processed by the model is increased, thereby improving the detection efficiency of Webshell scripts.

[0017] In other embodiments provided in the present application, if the web page traffic contains any one of the scripting languages ​​php, asp, aspx, jsp and jsp, then before executing the step of decoding the web page traffic to obtain a readable string, the method also includes: if the web page traffic is a web file and the web page traffic is a non-binary file, or the web page traffic is an image, then determining whether the web page traffic contains any one of the scripting languages ​​php, asp, aspx, jsp and jsp; if the web page traffic is a non-web file, or the web page traffic is a web file and the web page traffic is a binary file that is not an image, then ending the detection.

[0018] Since Webshells usually upload files in the form of Web files or images and invade servers, if the web page traffic is determined to be a binary file that is not a Web file or an image, the detection is terminated directly. This ensures that the detection accuracy is not significantly reduced and the amount of data processed by the model is increased, thereby improving the detection efficiency of Webshell scripts.

[0019] In other embodiments provided in the present application, before obtaining the web page traffic received by the target Web application, the method also includes: obtaining multiple normal samples and multiple Webshell samples; processing the multiple normal samples and multiple Webshell samples into the encoding method of the specified computer operating system to obtain unified multiple normal samples and multiple Webshell samples; decoding the unified multiple normal samples and multiple Webshell samples to obtain readable multiple normal samples and multiple Webshell samples; extracting feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features of the readable multiple normal samples and multiple Webshell samples; substituting the feature vectors of the multiple normal samples and multiple Webshell samples into the initial Webshell static detection model for training to obtain the Webshell static detection model.

[0020] During model training, multiple normal samples and multiple Webshell samples are first processed into specified computer codes, eliminating differences between samples from different computer systems, making the samples uniform and improving the accuracy of model training. Multiple normal samples and multiple Webshell samples are then decoded, using a unified decoding method to improve sample decoding efficiency. Feature vectors corresponding to the subjective, objective, combined, symbolic, and keyword features of the multiple normal and Webshell samples are then extracted and substituted into the model for training. Because these subjective, objective, combined, symbolic, and keyword features can comprehensively and accurately represent the samples, they can improve the efficiency and accuracy of model training, enhance the accuracy of the Webshell static detection model, and, consequently, improve the efficiency of static detection of Webshell scripts.

[0021] According to a second aspect of the present application, a static detection device for a Webshell script is provided, comprising: an acquisition module for acquiring web page traffic received by a target Web application; a decoding module for decoding the web page traffic to obtain a readable character string; an extraction module for extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of the readable character string, wherein the subjective features are command features of known Webshell scripts, the objective features are character statistical features of the readable character string, the combined features are combinations of command features of known Webshell scripts, the symbol features are special characters, and the keyword features are keywords related to the Webshell script; a detection module for inputting the feature vectors into a Webshell static detection model to obtain a detection result output by the Webshell static detection model, wherein the Webshell static detection model is trained based on feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of readable Webshell samples and normal samples; and a determination module for determining whether the web page traffic is a Webshell script based on the detection result.

[0022] A third aspect of the present application provides a computer device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the method in the first aspect.

[0023] A fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the steps of the method in the first aspect when the computer program is executed by a processor.

[0024] A fifth aspect of the present application provides a computer program product, comprising a computer program, which implements the steps of the method in the first aspect when the computer program is executed by a processor.

[0025] The static detection device for Webshell scripts provided in the second aspect of this application, the computer device provided in the third aspect, the computer-readable storage medium provided in the fourth aspect, and the computer program product provided in the fifth aspect have the same or similar beneficial effects as the static detection method for Webshell scripts provided in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The above and other objects, features and advantages of the exemplary embodiments of the present application will become readily understood by reading the detailed description below with reference to the accompanying drawings. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0027] Figure 1 Schematic diagram of an application scenario of a static detection method for a Webshell script in an embodiment of the present application;

[0028] Figure 2 The following is a flow diagram of the static detection method of the Webshell script in the embodiment of the present application: Figure 1 ;

[0029] Figure 3 Schematic diagram of the training method of the Webshell static detection model in an embodiment of the present application;

[0030] Figure 4 The following is a flow diagram of the static detection method of the Webshell script in the embodiment of the present application: Figure 2 ;

[0031] Figure 5 This is a schematic diagram of the structure of the static detection device of the Webshell script in the embodiment of the present application Figure 1 ;

[0032] Figure 6 This is a schematic diagram of the structure of the static detection device of the Webshell script in the embodiment of the present application Figure 2 ;

[0033] Figure 7 Schematic diagram of the structure of the computer device in the embodiment of the present application. DETAILED DESCRIPTION

[0034] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. Instead, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0035] It should be noted that, unless otherwise specified, the technical or scientific terms used in this application should have the common meanings understood by those skilled in the art to which this application belongs.

[0036] Currently, in Webshell static detection, different Webshell static detection models are used to detect Webshell scripts for web page traffic in different coding languages. In this way, for the same web page traffic, either the coding language of the web page traffic needs to be identified first, and then a model trained with the same coding language needs to be called for detection, or multiple models trained with different coding languages ​​need to be called for multiple detections of the same web page traffic. Identifying the coding language and using multiple models for detection will consume more time and reduce the efficiency of Webshell script static detection. In addition, Webshell scripts can use various coding languages, and it is impossible to list all coding languages ​​one by one for training during model training. It may happen that there is no model of the corresponding coding language for the Webshell script to detect, causing the Webshell script to be mistaken for a normal web page file, thereby reducing the accuracy of Webshell script static detection.

[0037] In view of this, the present application embodiment provides a static detection method for a Webshell script, a static detection device for a Webshell script, a computer device, a computer-readable storage medium, and a computer program product. In the training of the Webshell static detection model, the Webshell samples corresponding to various coding languages ​​and normal samples are first subjected to readability decoding processing to eliminate the coding language differences between the samples, and then the feature vectors corresponding to the subjective features, objective features, combination features, symbol features, and keyword features of each sample are extracted and substituted into the model training. The trained model fully learns the comprehensive samples of various coding languages. After the subsequent web page traffic to be detected is processed into readable content, a model can be used to detect, thereby improving the efficiency of Webshell static detection. In addition, the subjective features, objective features, combination features, symbol features, and keyword features of the sample are used in the model training, and these features can represent the sample simply, accurately, and comprehensively. The model is based on the subjective features, objective features, combination features, symbol features, and keyword features of the web page traffic for detection. Compared with directly targeting the entire content of the web page traffic, it can improve the accuracy and efficiency of Webshell static detection.

[0038] It should be noted here that all components, data and related processing methods involved in this application are authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions.

[0039] First, the application scenario of the static detection method of the Webshell script provided in the embodiment of the present application is described.

[0040] Figure 1This is a schematic diagram of an application scenario of the static detection method of the Webshell script in the embodiment of the present application, see Figure 1 As shown, this scenario may include: Webshell static detection model.

[0041] Before using the Webshell static detection model to detect web page traffic, you need to train the Webshell static detection model first.

[0042] In order to enable a Webshell static detection model to detect web page traffic in various coding languages, it is necessary to first decode each Webshell sample and normal sample into a readable Webshell sample and normal sample, and then extract the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features of the readable Webshell sample and normal sample. Then, the extracted vectors and the identifiers of the Webshell sample and normal sample are substituted into the initial Webshell static detection model for model training, and finally a Webshell static detection model that can be used for web page traffic in various coding languages ​​is obtained.

[0043] When performing static webshell detection on a web application, the web traffic received by the web application is obtained and processed into a readable string. Feature vectors corresponding to the subjective, objective, combined, symbolic, and keyword features of the readable string are then extracted. The extracted feature vectors are then input into a webshell static detection model. The webshell static detection model processes the feature vectors and outputs a detection result. If the detection result indicates maliciousness, the webpage traffic is determined to be a webshell script. If the detection result indicates normality, the webpage traffic is determined to be a normal webpage file.

[0044] Below, the static detection method of the Webshell script provided in the embodiment of the present application is described in detail.

[0045] Figure 2 The following is a flow diagram of the static detection method of the Webshell script in the embodiment of the present application: Figure 1 , see Figure 2 As shown, the method may include:

[0046] S21: Obtain web page traffic received by the target web application.

[0047] The target web application is the web application that requires static detection of webshell scripts.

[0048] While the target web application is running, it receives user-uploaded content and sends it to the server. The server processes the received content, generates feedback, and sends it to the target web application's client. The client displays the feedback. In this way, users can achieve their desired goals through the target web application client.

[0049] If the user is legitimate, the content uploaded is likely safe and poses no threat to the server. However, if the user is malicious, the content uploaded could be a webshell script. Once received by the server, the webshell script could pose a security threat, stealing or tampering with data on the server.

[0050] Therefore, every piece of content, or web traffic, sent by the target web application to the server must be intercepted and then tested. If no anomalies are detected, the server is instructed to process the traffic. If an anomaly is detected, the traffic is deleted to prevent the server from being attacked due to processing the traffic. A warning message is also sent to the server, alerting staff to take preventative measures.

[0051] It should be noted that the execution entity of the embodiments of the present application can be a component deployed in a web application client. When the web application client receives web traffic, the component intercepts the web traffic and detects the intercepted web traffic. If it is determined that the web traffic is not a webshell script, the component then causes the client to send the web traffic to the server. If it is determined that the web traffic is a webshell script, the component directly deletes the web traffic, and the client does not send the web traffic to the server.

[0052] The execution subject of the embodiments of the present application may also be a component deployed in a web application server. When the server receives web traffic sent by a web application client, the component first detects the web traffic. If it determines that the web traffic is not a webshell script, it then instructs the server to process the web traffic. If it determines that the web traffic is a webshell script, the component directly deletes the web traffic, so that the server no longer processes the web traffic.

[0053] The execution entity of the embodiments of the present application can also be a component deployed outside of a web application and connected to the web application. When the web application client sends web traffic to the server, the component intercepts the web traffic being sent and detects the intercepted web traffic. If it is determined that the web traffic is not a webshell script, the component will send the web traffic to the server. If it is determined that the web traffic is a webshell script, the component will directly delete the web traffic, and the server will no longer receive the web traffic, thereby ensuring the data security of the server.

[0054] S22: Decode the web page traffic to obtain a readable character string.

[0055] After obtaining the web page traffic received by the target web application, since different web applications adopt different encoding methods, and different web applications adopt different encoding methods in different computer systems, and the web page traffic and the web application require the same encoding method, it is necessary to first convert the obtained web page traffic into content with a unified expression, that is, decode the web page traffic into a readable string.

[0056] A readable string is one that can be read and understood by humans. For example, using Unicode-escape decoding: decoded_str = escaped_str.encode('utf-8').decode('unicode-escape'), print(decoded_str) # Output: "Hello, World!". "decoded_str" is the webpage URL, and "Hello, World!" is the readable string.

[0057] During specific decoding, the encoding method of the web page traffic can be identified first, and then the decoding method corresponding to the encoding method can be determined, so as to use the decoding method to decode the web page traffic and obtain a readable character string.

[0058] To identify the encoding method of web traffic, different encoding methods have corresponding characteristics. For example, the characteristic of ASCII encoding is that it uses 7 bits to represent characters and only supports 128 characters. Another example is that the characteristic of UTF-8 encoding is that "English takes up 1 byte, Chinese takes up 3-4 bytes, and 1-4 bytes are used to dynamically represent characters." Therefore, the actual encoding method of traffic can be determined based on the traffic characteristics.

[0059] During specific decoding, web page traffic can also be decoded using various decoding methods. Since only the decoding method corresponding to the encoding method of the web page traffic can decode a readable character string that can represent the true meaning of the web page traffic, it is possible to check whether the meaning of each decoded character string is clear and complete, and then use the character string with a clear and complete meaning as the readable character string decoded from the web page traffic, thereby achieving accurate decoding of the readable character string.

[0060] S23: Extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of the readable character string.

[0061] Subjective features, objective features, combined features, symbol features, and keyword features can simply, accurately, and comprehensively characterize Webshell scripts. Therefore, through the subjective features, objective features, combined features, symbol features, and keyword features of readable strings, Webshell can be detected efficiently and accurately. The specific explanation of each feature is as follows:

[0062] (1) Subjective features are command features of known Webshell scripts. For currently discovered Webshell scripts, special commands that are different from normal web page files can be extracted from the Webshell scripts, and the extracted special commands can be used as subjective features. Subjective features can also be special commands in Webshell scripts that are manually summarized based on historically discovered Webshell scripts. Subjective features can be commands for deleting traces, for example: rm-rf / var / log / auth.log#Linux delete log, del C:\Windows\Temp\*.* / q#Windows silent delete. The specific content of the subjective features is not limited here.

[0063] (2) Objective features are character statistics of readable strings. The character patterns of Webshell scripts and normal web page files are somewhat different. Therefore, extracting objective features of web page traffic can effectively identify whether the web page traffic is a Webshell script.

[0064] In practical applications, objective features can be various character statistical features, such as the proportion of uncommon characters, text entropy, average word length, etc.

[0065] (3) The combined feature is a combination of command features of known Webshell scripts. Since some special commands in Webshell scripts also appear in normal web page files, for example, the view / download commands in Webshell scripts also appear in normal web page files, because users normally download files from Web applications, some special commands in Webshell scripts can be combined and then used as a combined feature to improve the accuracy of Webshell script recognition.

[0066] The specific combinations of special commands within a Webshell script can be freely determined based on the specific situation and are not limited here. For example, similar commands appearing in a Webshell script can be categorized and the summarized command features can be used as combination features. Similar commands can include registry operations, command execution lines, and so on. Another example is combining download commands with deletion commands as a combination feature.

[0067] (4) The symbolic features are special characters. There are certain differences between the special characters in Webshell scripts and normal web page files. Therefore, extracting the symbolic features of web page traffic can effectively identify whether the web page traffic is a Webshell script.

[0068] In practical applications, symbol features can be various special characters, such as: #, !, etc.

[0069] (5) Keyword features are keywords related to Webshell scripts. In Webshell scripts, some keywords related to Webshell scripts also appear. By extracting keyword features from web traffic, it is also possible to effectively identify whether web traffic is a Webshell script.

[0070] In actual applications, keyword features can be various keywords related to Webshell scripts, such as: Webshell, cedshell, sistem, asert, etc.

[0071] When extracting feature vectors corresponding to subjective, objective, combined, symbolic, and keyword features from a readable string, each subjective feature can be searched within the readable string. If a subjective feature is found, the corresponding value in the feature vector can be 1; if a subjective feature is not found, the corresponding value in the feature vector can be 0. Next, each objective feature is searched within the readable string, using the same search method and corresponding value generation method as for the subjective features. Similarly, each combined, symbolic, and keyword feature is searched and generated from the readable string, and the corresponding values ​​are generated. Finally, the corresponding values ​​for each subjective, objective, combined, symbolic, and keyword feature are combined to obtain feature vectors corresponding to the subjective, objective, combined, symbolic, and keyword features of the readable string.

[0072] How many features are included in subjective features, objective features, combination features, symbol features and keyword features, and how many values ​​are specifically included in the feature vector.

[0073] It should be noted here that the order of the values ​​corresponding to each feature in the generated feature vector needs to be consistent with the order of each feature in the feature vector extracted from the training sample during model training.

[0074] The order of the numerical values ​​in the feature vector can be sorted in the order of subjective features, objective features, combination features, symbol features and keyword features. In this way, the direct data (corresponding commands, keywords, etc.) indicating the Webshell script can be separated from the indirect data (symbol statistics and special symbols) during model training, so that the model can be fully learned in a staggered manner, thereby improving the model accuracy and further improving the accuracy of static detection of Webshell scripts.

[0075] Searching and generating corresponding numerical values ​​in the readable string based on the order of each feature in the feature vector ensures accurate feature vector generation and improves the accuracy of feature vector generation. To improve detection efficiency, numerical values ​​corresponding to each feature can be generated in parallel when generating the feature vector, improving feature vector generation efficiency and, in turn, detection efficiency.

[0076] It should be noted that the values ​​1 and 0 in the above-mentioned eigenvectors are only examples, and the values ​​in the eigenvectors can also be other values ​​or other symbols, such as 1 and 2, or a and b.

[0077] S24: Input the feature vector into the Webshell static detection model to obtain a detection result output by the Webshell static detection model.

[0078] Among them, the Webshell static detection model is trained based on the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features of readable Webshell samples and normal samples.

[0079] Because the input to the Webshell static detection model training is the feature vectors corresponding to the subjective, objective, combined, symbolic, and keyword features of the training sample, and the output is the normal identification or Webshell identification of the corresponding sample, to ensure detection accuracy, the Webshell static detection model also inputs the feature vectors corresponding to the subjective, objective, combined, symbolic, and keyword features of the webpage traffic. The feature vectors are processed by the model, and the model outputs the detection results.

[0080] S25: Determine whether the web page traffic is a Webshell script based on the detection result.

[0081] If the detection result indicates normal, it indicates that the feature vector is likely to be a feature vector of a normal web page file, and the web page traffic corresponding to the input feature vector is determined to be a normal web page file. If the detection result indicates Webshell, it indicates that the feature vector is likely to be a feature vector of a Webshell script, and the web page traffic corresponding to the input feature vector is determined to be a Webshell script.

[0082] The specific content indicating normal or webshell in the detection result can be set according to actual needs and is not limited here. For example, 0 indicates normal and 1 indicates webshell.

[0083] As can be seen from the above, the static detection method of the Webshell script provided by the embodiment of the present application adopts readable Webshell samples and normal samples in the Webshell static detection model training, which can overcome the differences between the training samples of different programming languages, so that the training samples of various programming languages ​​can be trained in the same model. In addition, by adopting the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features of the Webshell samples and normal samples, a more streamlined training sample can be obtained in the model training. The trained model can accurately and efficiently detect the web page traffic of different programming languages. The web page traffic to be detected is first processed into a readable string, and then the feature vectors corresponding to the subjective features, objective features, combination features, symbol features and keyword features are extracted, and then input into the model for detection. Using one model, web page traffic detection of various programming languages ​​can be realized, and the accuracy and efficiency of static detection of Webshell scripts can be improved.

[0084] Furthermore, as a Figure 2 A refinement and extension of the method shown, an embodiment of the present application also provides a static detection method for Webshell scripts.

[0085] Since the static detection method of the Webshell script uses the Webshell static detection model during detection, the Webshell static detection model needs to be trained in advance.

[0086] Figure 3 This is a schematic diagram of the training method of the Webshell static detection model in the embodiment of the present application, see Figure 3 As shown, the method may include:

[0087] S31: Obtain multiple normal samples and multiple Webshell samples.

[0088] Normal samples can refer to web page files that have been received by various web applications and have been determined to be normal. Web shell samples can refer to web page files that have been received by various web applications and have been determined to be web shells.

[0089] There is no limit on the specific number of normal samples and Webshell samples obtained.

[0090] In practice, multiple legitimate samples and webshell samples can be obtained from the cloud. The cloud can refer to a database storing web page files for various web applications, a specific web application server, or a cloud storage space. Security experts can upload legitimate and webshell samples to the cloud storage space for direct access during model training.

[0091] S32: Process the multiple normal samples and the multiple Webshell samples into an encoding method of a specified computer operating system to obtain unified multiple normal samples and multiple Webshell samples.

[0092] To ensure model training accuracy, multiple normal samples and webshell samples are collected from different web applications or computer operating systems. Different web applications or computer operating systems use different encoding methods, resulting in different encoding methods for the normal and webshell samples. To improve sample decoding accuracy and efficiency, the encoding differences between the computer operating systems can be eliminated. Subsequently, decoding can be performed based solely on the sample's own encoding method.

[0093] The computer operating system here may refer to an operating system such as Windows, Linux, etc. that can run Web applications.

[0094] Processing the sample into the encoding of a designated computer operating system can involve selecting any one of the computer operating systems corresponding to multiple samples, or the computer operating system with the most samples, as the designated computer operating system. This can reduce the number of samples to be processed and improve the efficiency of eliminating differences in encoding methods between computer operating systems. Processing the sample into the encoding of a designated computer operating system can also involve selecting a computer operating system other than the computer operating systems corresponding to the multiple samples as the designated computer operating system. This allows for flexible designation of the designated computer operating system, allowing for a more universal or stable computer operating system to be designated as the designated computer operating system, thereby making sample conversion more accurate.

[0095] In actual applications, encoding differences between samples in computer operating systems can refer to character encoding, file paths, line breaks, environment variables, command line syntax, etc. Between multiple samples, these differences are also eliminated here.

[0096] After the encoding differences between multiple samples in computer operating systems are eliminated, sample deduplication can be performed to avoid using duplicate samples for model training and improve the efficiency of model training.

[0097] S33: Decode the unified multiple normal samples and multiple Webshell samples to obtain multiple readable normal samples and multiple Webshell samples.

[0098] After the encoding differences between multiple samples in computer operating systems are eliminated, the encoding methods of the samples themselves can be decoded.

[0099] During specific decoding, for each sample, corresponding decoding can be performed according to the encoding method of the sample. Identifying the encoding method in the sample and decoding the sample using the corresponding decoding method has been described in detail in step S22 of the aforementioned embodiment and will not be repeated here. For each sample, various common decoding methods can also be used to decode multiple samples. For example: the sample is sequentially decoded with unicode fragments, decoded with 8 / 16 hexadecimal fragments, decoded with base64 fragment splicing, and encoded with utf8. Of course, the order of use of the various decoding methods in the above examples can be adjusted according to actual conditions.

[0100] After the sample is decoded, operations such as string splitting and generalization can be performed on the decoded sample to make the sample easier to perform feature recognition, thereby improving the accuracy of feature vector acquisition.

[0101] S34: Extract feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of multiple readable normal samples and multiple Webshell samples.

[0102] For each legitimate sample and each webshell sample, a feature vector corresponding to the subjective, objective, combined, symbolic, and keyword features must be obtained. That is, each sample corresponds to one feature vector. Each feature vector must contain the corresponding values ​​for the subjective, objective, combined, symbolic, and keyword features.

[0103] The specific method of extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features and keyword features from the sample has been described in detail in step S23 of the aforementioned embodiment and will not be repeated here.

[0104] After each sample is processed, the processed samples can be used for model training.

[0105] S35: Substitute the feature vectors of multiple normal samples and multiple Webshell samples into the initial Webshell static detection model for training to obtain the Webshell static detection model.

[0106] The initial Webshell static detection model can be an initial artificial neural network model built based on the static detection requirements of Webshell scripts, which still needs to be further trained with samples. The specific type of the initial Webshell static detection model is not limited here.

[0107] In practical applications, the initial static Webshell detection model can use the Extremely Randomized Trees (Extra-Trees) model. Leveraging the stronger randomness of the Extra-Trees model, it can avoid interference between different sample features and improve the accuracy of the trained model.

[0108] During the specific training of the model, the feature vectors of multiple normal samples and multiple Webshell samples can be randomly shuffled, and the training set and test set can be divided into a ratio of 8:2 (other ratios are also possible). The initial Webshell static detection model is trained using the samples in the training set and their labels indicating they are normal or Webshell. Then, the trained Webshell static detection model is tested using the samples in the test set and their labels indicating they are normal or Webshell. The trained model is then optimized based on the test results. The optimized Webshell static detection model is the Webshell static detection model that is ultimately used for static detection of Webshell scripts.

[0109] During specific optimization, one or a combination of methods such as adjusting parameters, analyzing missed and false positive samples, adding and deleting features, and adjusting the training set can be used to optimize the trained model.

[0110] Specifically, when optimizing a model through parameter tuning, the values ​​of any parameters in the trained model can be adjusted. The adjusted model is then retested using the test set until the accuracy reaches the preset threshold. The adjusted model with the preset accuracy threshold is the final Webshell static detection model.

[0111] When optimizing the model by analyzing missed and false positive samples, the Webshell samples that were not detected by the trained model in the test set and the normal samples that were mistakenly identified as Webshell scripts by the trained model in the test set and their corresponding labels can be substituted into the trained model for training again. The retrained model will serve as the final Webshell static detection model.

[0112] When optimizing a model by adding or deleting features, one or more specified feature vector values ​​can be deleted from the feature vectors of each sample in the test set. The trained model is then retrained using these deleted feature vectors, and then tested using several samples from the training set. When deleting feature vector values ​​from the feature vectors of each sample in the test set, different features or feature combinations can be selected for deletion. Consequently, multiple retrained models are obtained. When testing using several samples from the training set, the model with the highest accuracy is selected as the final Webshell static detection model.

[0113] When adjusting the training set for model optimization, more normal samples and Webshell samples can be obtained, and the normal samples and Webshell samples obtained again are processed using the methods in S32, S33, and S34 above to generate a new training set. The trained model is then trained again using the new training set, and the retrained model is then tested using the test set. If the accuracy of the model test improves, the retrained model is used as the final Webshell static detection model. If the accuracy of the model test does not improve or even decreases, new training sets are continued to be obtained until the accuracy of the retrained model under the test set is improved, and the model with improved accuracy is used as the final Webshell static detection model.

[0114] The final Webshell static detection model is a model that can actually be used for static detection of Webshell scripts.

[0115] During the management and deployment of Webshell static detection models, the models must be encrypted and compressed to ensure confidentiality and portability. Conventional data encryption and compression methods can be used for encryption and compression, and are not specified here.

[0116] At this point, the Webshell static detection model has been obtained through training.

[0117] Next, you can use the Webshell static detection model to perform static detection of Webshell scripts on Web applications.

[0118] Figure 4 The following is a flow diagram of the static detection method of the Webshell script in the embodiment of the present application: Figure 2 , see Figure 4 As shown, the method may include:

[0119] S41: Obtain web page traffic received by the target web application.

[0120] The specific implementation method of step S41 here is the same as that of step S21 in the aforementioned embodiment. Please refer to the relevant description in the aforementioned embodiment and will not be repeated here.

[0121] S42: Determine whether the web page traffic is a web file. If yes, execute S43; if no, execute S411.

[0122] Sometimes, for various reasons, web applications receive data in non-web standard formats. Because this data doesn't conform to web application standards, it's not processed by the web application. Even if this data is malicious, it won't be processed by the web application and won't successfully intrude on the server.

[0123] To ensure the accuracy of static detection of Webshell scripts, in order to reduce the detection volume and improve detection efficiency, you can first delete non-Web files from the web page files received by the target Web application, leaving only Web files for detection.

[0124] Since web file formats are generally fixed, the specific determination can be made by matching the acquired web traffic with a preset web file format (the upload format supported by the target web application). That is, the web traffic is searched for characters or data features of the preset web file format. If the match is successful, the acquired web traffic is determined to be a web file. If the match fails, the acquired web traffic is determined to be a non-web file.

[0125] Web file formats may include: .docx (Word), .xlsx (Excel), .pptx (PowerPoint), .pdf (PDF document), .txt (plain text), .rtf (rich text), .epub, .mobi (Kindle format), .jpg, .png, .gif, .webp (commonly used on web pages), .tiff (lossless image), .psd (Photoshop source file), .ai (Illustrator file), .svg (scalable vector image), .eps (printing vector image), .mp3, .wav (lossless audio), .flac (compressed lossless), .aac, .mp4, .mov (Apple format), .avi, .mkv (high-definition packaging), .prproj (Premiere), .aep (After Effects), etc. Effects), .zip, .rar, .7z, .iso (CD-ROM image), .dmg (Mac installation package), .exe (Windows executable file), .py (Python), .java, .cpp, .go (non-Web language), .json, .yaml, .xml (although used for Web transmission, it can also be uploaded as an independent file), .sql (database script), .db (SQLite database), .csv (data table export), .stl (3D printing model), .obj, .dwg (AutoCAD), .shp (Shapefile map data), .kml (Google Earth), .fits (astronomical image), .nc (NetCDF meteorological data), .ttf, .otf (open font), .ova (virtual machine template), .vmdk (virtual disk), .sch (circuit diagram), .pcb (PCB design file), etc.

[0126] As for the data characteristics of Web files, taking HTML files as an example, the data characteristics are: <tag>) composed of a tree structure (DOM), including hyperlinks ( ), resource references ( 、 <script src>)，支持嵌入式元数据(<meta>)和SEO相关标签。

[0127] S43：判断网页流量是否为二进制文件。若是，则执行S44，若否，则执行S45。

[0128] 在网页流量为Web文件的情况下，有时，Webshell脚本会伪装成图片入侵Web服务器。而图片在Web文件中都是以二进制文件的形式存在。对于Web文件中的非二进制文件，仍然存在Webshell脚本的可能。因此，需要将Web文件中的非二进制文件进行检测。

[0129] 对于Web文件中的二进制文件，Webshell脚本通常以图片形式入侵，二进制文件中的非图片文件，无需检测。

[0130] 具体判断时，由于二进制文件采用的数据均为0、1，因此，可以判断网页流量中是否仅包含0或1，若是，则确定网页流量为二进制文件，若否，则确定网页流量为非二进制文件。

[0131] S44：判断网页流量是否为图片。若是，则执行S45，若否，则执行S411。

[0132] 有时，恶意用户会将Webshell脚本伪装为图片直接向Web应用上传，为了提高图片中Webshell检测效率，可以直接检测上传的网页流量是否为图片。

[0133] 具体判断时，可以判断网页流量中是否包含图片的格式。图片的格式例如：.jpg、.png、.gif，等等。如果网页流量中包含某图片格式，则确定网页流量为图片。如果网页流量中不包含预先列出的各种图片格式，则确定网页流量为非图片。从而基于网页流量是否为Web文件、是否为非二进制文件等确定是否继续进行检测。

[0134] 总的来说，通过上述步骤S42-S44，将非Web文件、Web文件中的二进制文件中的非图片，由于其不会作为Webshell脚本成功入侵Web服务器，因此可以跳过检测，认为相应的网页流量不是Webshell脚本。针对Web文件中的非二进制文件和Web文件中的二进制文件中的图片送入检测，以提高检测效率。

[0135] 当然，为了提高检测精度，也可以直接将网页流量送入检测。

[0136] 在采用模型检测网页流量前，可以再次对网页流量进行筛选，将较大概率不属于Webshell脚本的网页流量过滤。

[0137] S45：判断网页流量中是否包含php、asp、aspx、jsp和jspx中任一种脚本语言。若是，则执行S46，若否，则执行S411。

[0138] 一般来说，Webshell脚本通常采用php、asp、aspx、jsp和jspx中的一种语言编辑。因此，判断网页流量中是否包含php、asp、aspx、jsp和jspx中任一种脚本语言，能够将明显为非Webshell脚本的网页流量跳出检测，进而提高Webshell脚本静态检测效率。

[0139] 具体判断时，由于脚本语言php、asp、aspx、jsp和jspx都具有对应的数据特征，例如：扩展名为：.php、.php5、.phtml等；MIME类型为：application / x-httpd-php；文件结构为：混合HTML、PHP代码和嵌入式脚本，以及以<？php开头，？>结尾，等等，如果从网页流量中识别出上述某一脚本语言的数据特征，则确定网页流量采用该脚本语言，如果从网页流量中均未识别出上述各个脚本语言的数据特征，则确定网页流量没有采用php、asp、aspx、jsp和jspx的脚本语言。

[0140] S46：对网页流量依次进行多种解码处理，得到可读字符串。

[0141] Web应用具有多种标准格式，不同的标准格式对应不同的编码方式。在符合Web应用格式标准的情况下，网页流量可能采用多种编码方式中的任一种编码方式进行编码，为了确保网页流量能够得到正确且充分的解码，可以对网页流量依次采用多种解码方式进行解码。

[0142] 也就是说，先对网页流量采用第一种解码方式进行解码，得到第一字符串，再对网页流量采用第二种解码方式进行解码，得到第二字符串。有多少种预设的解码方式，就按照上述方式进行多少次解码，最终得到可读字符串。

[0143] 举例来说，依次对网页流量进行unicode片段解码、8 / 16进制片段解码、base64片段拼接解码处理，得到可读字符串。

[0144] 这里需要说明的是，上述的各种解码方式的使用顺序可以根据实际情况确定，此处不做限定。

[0145] 在采用多种解码方式对网页流量进行解码时，有时某一种或者某几种解码方式已经对网页流量实现完全解码。此时，无需使用所有预设的解码方式对网页流量进行解码，以提高网页流量的解码效率。

[0146] 具体来说，上述步骤S46可以包括：在对网页流量进行多种编码中的一种编码处理后，若网页流量中的全部字符均完成转换，则得到可读字符串。

[0147] 在多个解码方式中，可以根据实际情况先选择一种解码方式对网页流量进行解码，并且判断网页流量中各字符是否都进行了相应的转换。若是，则确定网页流量已经全部实现解码，不再采用剩余的解码方式继续对前次解码后的网页流量继续解码。若否，则继续采用另一种解码方式对前次解码后的网页流量继续解码，直到判断出网页流量中各字符都进行了相应的转换。

[0148] 从多个解码方式中选择解码方式的顺序，可以是随机的，也可以选择历史使用次数最多的解码方式，以更快的完成网页流量的全部解码，提高网页流量的解码效率。

[0149] 在判断网页流量中各字符是否进行了转换的过程中，可以先判断网页流量中的每个字符或者每个字符组是否被提取，并且，每个字符或者每个字符组中的字符是否被替换。若每个字符或者每个字符组被提取，并且，每个字符或者每个字符组中的字符被替换，则确定网页流量中各字符都进行了转换，若有字符或者字符组未被提取，或者，每个字符或者每个字符组被提取，但是有字符或者有字符组中的字符未被替换，则确定网页流量中还有字符没有进行转换，网页流量中各字符未转换完成。

[0150] S47：对可读字符串进行变长编码、字符串拆分和泛化中的至少一项操作，得到标准字符串。

[0151] 变长编码，可以是指在原字符串的基础上，为每个字符串或者字符串组合增加字符。这样，能够提高可读字符串含义的表达能力，消除可读字符串中的乱码。例如：utf8编码。

[0152] 字符串拆分，可以是指将原字符串按照含义不同拆分为多个字符或者字符组合。这样，使得可读字符串更加便于进行特征提取，提高特征提取的效率和准确性。

[0153] 泛化，可以是指将原字符串中的字符或者字符组合按照某种规则进行标准化或抽象化处理，使其能够匹配更广泛的模式或适应不同的使用场景。这样，在保障特征准确提取的同时，能够更加便捷的进行特征提取，提高特征提取的效率和准确性。

[0154] S48：提取标准字符串的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量。

[0155] S49：将特征向量输入Webshell静态检测模型，得到Webshell静态检测模型输出的检测结果。

[0156] S410：根据检测结果确定网页流量是否为Webshell脚本。

[0157] 这里的步骤S48、S49、S410与前述实施例中步骤S23、S24、S25的具体实现方式相同，可参见前述实施例中的相关说明，此处不再赘述。

[0158] S411：结束检测。

[0159] 对于非Web文件、Web文件中的二进制文件中的非图片，由于其即便作为Webshell脚本也不会成功入侵Web服务器，或者较大概率不会作为Webshell脚本入侵Web服务器，因此，可以结束这些文件的网页流量的检测，进而确定对应的网页流量不是Webshell脚本，是正常网页文件。

[0160] 至此，本申请实施例提供的Webshell脚本的静态检测方法已经全部说明完成。

[0161] 基于同一发明构思，本申请实施例还提供了一种Webshell脚本的静态检测装置。

[0162] 图5为本申请实施例中Webshell脚本的静态检测装置的结构示意图一，参见图5所示，该装置可以包括：

[0163] 获取模块51，用于获取目标Web应用接收的网页流量。

[0164] 解码模块52，用于对网页流量进行解码处理，得到可读字符串。

[0165] 提取模块53，用于提取可读字符串的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量，主观特征为已知Webshell脚本的命令特征，客观特征为可读字符串的字符统计特征，组合特征为已知Webshell脚本的命令特征的组合，符号特征为特殊字符，关键字特征为与Webshell脚本相关的关键字。

[0166] 检测模块54，用于将特征向量输入Webshell静态检测模型，得到Webshell静态检测模型输出的检测结果，Webshell静态检测模型基于可读的Webshell样本和正常样本的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量训练得到。

[0167] 确定模块55，用于根据检测结果确定网页流量是否为Webshell脚本。

[0168] 进一步地，作为对图5所示装置的细化和扩展，本申请实施例还提供了一种Webshell脚本的静态检测装置。

[0169] 图6为本申请实施例中Webshell脚本的静态检测装置的结构示意图二，参见图6所示，该装置可以包括：

[0170] 训练模块61，用于获取多个正常样本和多个Webshell样本；将多个正常样本和多个Webshell样本处理为指定计算机操作系统的编码方式，得到统一后的多个正常样本和多个Webshell样本；对统一后的多个正常样本和多个Webshell样本进行解码处理，得到可读的多个正常样本和多个Webshell样本；提取可读的多个正常样本和多个Webshell样本的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量；将多个正常样本和多个Webshell样本的特征向量代入初始的Webshell静态检测模型进行训练，得到Webshell静态检测模型。

[0171] 获取模块62，用于获取目标Web应用接收的网页流量。

[0172] 预选模块63，用于若网页流量中包含php、asp、aspx、jsp和jspx中任一种脚本语言，则进入解码模块64；若网页流量中不包含php、asp、aspx、jsp和jspx中任一种脚本语言，则结束检测。

[0173] 预选模块63，还用于若网页流量为Web文件且网页流量为非二进制文件，或者，网页流量为图片，则判断网页流量中是否包含php、asp、aspx、jsp和jspx中任一种脚本语言；若网页流量为非Web文件，或者，网页流量为Web文件且网页流量为非图片的二进制文件，则结束检测。

[0174] 解码模块64，用于对网页流量依次进行多种解码处理，得到可读字符串。

[0175] 解码模块64，具体用于在对网页流量进行多种编码中的一种编码处理后，若网页流量中的全部字符均完成转换，则得到可读字符串。

[0176] 优化模块65，用于对可读字符串进行变长编码、字符串拆分和泛化中的至少一项操作，得到标准字符串。

[0177] 提取模块66，用于提取标准字符串的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量。

[0178] 检测模块67，用于将特征向量输入Webshell静态检测模型，得到Webshell静态检测模型输出的检测结果，Webshell静态检测模型基于可读的Webshell样本和正常样本的主观特征、客观特征、组合特征、符号特征和关键字特征对应的特征向量训练得到。

[0179] 确定模块68，用于根据检测结果确定网页流量是否为Webshell脚本。

[0180] 这里需要指出的是，以上装置实施例的描述，与上述方法实施例的描述是类似的，具有同方法实施例相似的有益效果。对于本申请装置实施例中未披露的技术细节，请参照本申请方法实施例的描述而理解。

[0181] 基于同一发明构思，本申请实施例还提供了一种计算机设备。

[0182] 图7为本申请实施例中计算机设备的结构示意图，参见图7所示，该计算机设备可以包括：存储器71、处理器72及存储在存储器71上的计算机程序，处理器72执行计算机程序以实现前述实施例中的方法。

[0183] 这里需要指出的是，以上计算机设备实施例的描述，与上述方法实施例的描述是类似的，具有同方法实施例相似的有益效果。对于本申请计算机设备实施例中未披露的技术细节，请参照本申请方法实施例的描述而理解。

[0184] 基于同一发明构思，本申请实施例还提供了一种计算机可读存储介质。计算机可读存储介质上存储有计算机程序，该计算机程序被处理器执行时实现前述实施例中的方法。

[0185] 这里需要指出的是，以上计算机可读存储介质实施例的描述，与上述方法实施例的描述是类似的，具有同方法实施例相似的有益效果。对于本申请计算机可读存储介质实施例中未披露的技术细节，请参照本申请方法实施例的描述而理解。

[0186] 基于同一发明构思，本申请实施例还提供了一种计算机程序产品。计算机程序产品包括计算机程序，该计算机程序被处理器执行时实现前述实施例中的方法。

[0187] 这里需要指出的是，以上计算机程序产品实施例的描述，与上述方法实施例的描述是类似的，具有同方法实施例相似的有益效果。对于本申请计算机程序产品实施例中未披露的技术细节，请参照本申请方法实施例的描述而理解。

[0188] 以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。< / script> < / tag>

Claims

1. A static detection method for Webshell scripts, characterized in that: The method comprises: Obtain web traffic received by the target web application; Decoding the webpage traffic to obtain a readable character string; Extracting feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of the readable string, wherein the subjective features are command features of known Webshell scripts, the objective features are character statistical features of the readable string, the combined features are combinations of command features of known Webshell scripts, the symbol features are special characters, and the keyword features are keywords related to Webshell scripts; Inputting the feature vector into a Webshell static detection model to obtain a detection result output by the Webshell static detection model, wherein the Webshell static detection model is trained based on feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of readable Webshell samples and normal samples; Determine whether the web page traffic is a Webshell script based on the detection result.

2. The method according to claim 1, characterized in that Before extracting feature vectors corresponding to the subjective features, objective features, combined features, symbol features, and keyword features of the readable character string, the method further includes: Performing at least one of variable-length encoding, string splitting, and generalization on the readable string to obtain a standard string; The step of extracting feature vectors corresponding to the subjective features, objective features, combined features, symbol features, and keyword features of the readable character string includes: Extract feature vectors corresponding to the subjective features, objective features, combination features, symbol features, and keyword features of the standard character string.

3. The method according to claim 1, characterized in that The decoding process of the webpage traffic to obtain a readable string includes: The web page traffic is subjected to a plurality of decoding processes in sequence to obtain the readable character string.

4. The method according to claim 3, characterized in that The webpage traffic is subjected to a plurality of decoding processes in sequence to obtain the readable character string, including: After the webpage traffic is subjected to one of the multiple encodings, if all characters in the webpage traffic are converted, the readable character string is obtained.

5. The method according to claim 1, wherein Before decoding the webpage traffic to obtain a readable string, the method further includes: If the webpage traffic contains any scripting language among php, asp, aspx, jsp and jspx, performing a step of decoding the webpage traffic to obtain a readable string; If the web page traffic does not contain any scripting language among php, asp, aspx, jsp and jspx, the detection is terminated.

6. The method according to claim 5, characterized in that If the webpage traffic contains any scripting language among PHP, ASP, ASPX, JSP and JSPX, before performing the step of decoding the webpage traffic to obtain a readable string, the method further includes: If the web page traffic is a web file and the web page traffic is a non-binary file, or if the web page traffic is an image, determining whether the web page traffic contains any scripting language of php, asp, aspx, jsp, and jspx; If the web page traffic is a non-web file, or if the web page traffic is a web file and the web page traffic is a binary file that is not an image, then the detection is terminated.

7. The method according to any one of claims 1 to 6, characterized in that Before obtaining the webpage traffic received by the target web application, the method further includes: Obtain multiple normal samples and multiple Webshell samples; Processing the plurality of normal samples and the plurality of Webshell samples into an encoding method of a specified computer operating system to obtain a unified plurality of normal samples and the plurality of Webshell samples; Decode the unified multiple normal samples and multiple Webshell samples to obtain multiple readable normal samples and multiple Webshell samples; Extract feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of multiple readable normal samples and multiple Webshell samples; Substituting feature vectors of multiple normal samples and multiple Webshell samples into an initial Webshell static detection model for training, the Webshell static detection model is obtained.

8. A static detection device for Webshell scripts, characterized in that: The device comprises: An acquisition module, used to obtain web page traffic received by the target web application; A decoding module, configured to decode the webpage traffic to obtain a readable string; An extraction module is used to extract feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of the readable string, wherein the subjective features are command features of known Webshell scripts, the objective features are character statistical features of the readable string, the combined features are combinations of command features of known Webshell scripts, the symbol features are special characters, and the keyword features are keywords related to Webshell scripts; A detection module is used to input the feature vector into a Webshell static detection model to obtain a detection result output by the Webshell static detection model, wherein the Webshell static detection model is trained based on feature vectors corresponding to subjective features, objective features, combined features, symbol features, and keyword features of readable Webshell samples and normal samples; A determination module is used to determine whether the web page traffic is a Webshell script based on the detection result.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images