Malicious code detection method and device for SSH backdoor
By calculating the digest value of SSH service files and monitoring process behavior, the problem of SSH backdoor detection has been solved, achieving efficient and reliable detection of SSH backdoors and improving the accuracy of detection.
Patent Information
- Application Number
- CN202511659993.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-13
- Publication Date
- 2026-03-27
AI Technical Summary
Existing technologies are insufficient to effectively detect and defend against SSH backdoors, especially when SSH backdoors are updated and their signatures become invalid or they bypass authentication directly, making it impossible to achieve large-scale, systematic detection.
By comparing the digest value of the SSH service file with the pre-stored value, the file type, size, and packing technology attributes are detected, and process behavior, including reading and writing of encrypted log files, abnormal execution, and file tampering time, is monitored to determine whether the file has been tampered with or is abnormal.
It improves the accuracy and reliability of SSH backdoor detection, effectively identifies and defends against SSH backdoors, and enhances the detection accuracy.
Smart Images
Figure CN121744309A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network information security technology, and in particular to a method and apparatus for detecting malicious code targeting SSH backdoors. Background Technology
[0002] SSH (Secure Shell) is a reliable protocol designed to provide security for remote login sessions and other network services. Originally a program on UNIX systems, SSH quickly expanded to other operating platforms. Common SSH tools today include OpenSSH and Dropbear SSH.
[0003] SSH service is the most widely used remote management service for UNIX systems. In many scenarios, it inevitably needs to be exposed to the outside world. Therefore, using normal SSH service and traffic to hide attack traces has become one of the important methods for attackers to conduct covert attacks. After exploiting public or private vulnerabilities to compromise network boundary devices (such as firewalls and routers), these organizations inject malicious code into the SSH service by replacing normal SSH service files, thereby achieving persistent SSH backdoors and long-term control. Because the implementation methods of SSH backdoors are highly varied, and the methods of concealing attack samples and traffic are diverse, it is difficult to effectively detect and defend against SSH backdoors without sufficient knowledge of the attackers.
[0004] Current mainstream SSH backdoor detection methods rely on reverse engineering to extract backdoor features or detecting unauthorized SSH backdoor accounts through SSH configuration files. However, once an SSH backdoor is updated, previously identified features may become invalid; some SSH backdoors can bypass SSH authentication directly without reading SSH configuration files. Therefore, existing technologies cannot achieve large-scale, systematic SSH backdoor detection. Summary of the Invention
[0005] This invention provides a method and apparatus for detecting malicious code targeting SSH backdoors, in order to solve at least one of the above-mentioned technical problems.
[0006] This invention provides a method for detecting malicious code targeting SSH backdoors, comprising the following steps:
[0007] Calculate the digest value of the target SSH service file and compare it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with;
[0008] Detect the file type, size, and whether the SSH service file uses packing techniques to determine if the file is abnormal;
[0009] The process of tracking and monitoring SSH service files is used to detect any abnormal behavior during the process. Such abnormal behavior includes at least reading and writing encrypted log files, abnormal execution of operations, and tampering with file timestamps.
[0010] In some embodiments, determining whether a file has been tampered with specifically includes:
[0011] Collect and store the summary values of normal SSH service files under different system versions;
[0012] The calculated digest value of the target SSH service file is matched with the stored digest value, and the detection result is output.
[0013] If the detection result is a match, the file is determined not to have been tampered with.
[0014] If the detection result is a mismatch, the file is determined to have been tampered with.
[0015] In some embodiments, determining whether a file is abnormal specifically includes:
[0016] Check if the SSH service file is an ELF executable file. If it is, it is a normal file; otherwise, it is an abnormal file.
[0017] Check if the size of the SSH service file is within the normal range. If it is, it is a normal file; otherwise, it is an abnormal file.
[0018] This function checks whether SSH service files are packed or blocked. If so, they are considered abnormal files; otherwise, they are considered normal files.
[0019] In some embodiments, process behavior detection specifically includes:
[0020] Detect whether the process running the SSH service file is reading or writing critical SSH log files, and determine whether the log files are encrypted.
[0021] Detect whether the SSH service process is performing any abnormal operations.
[0022] This function checks if any processes running SSH service files have tampered with the file timestamps.
[0023] In some embodiments, the method for detecting malicious code targeting SSH backdoors also includes a logging function to record the detected file name, storage path, detection time, and detection results.
[0024] The present invention also provides a malicious code detection device for implementing the detection method described above, the device comprising:
[0025] File integrity detection module: used to calculate the digest value of the target SSH service file and compare it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with;
[0026] The file anomaly detection module is used to detect the file type, size, and whether the SSH service file uses packing technology to determine if the file is abnormal.
[0027] Process behavior detection module: used to track and monitor the process of SSH service files in order to detect whether there is any abnormal behavior during the process. The abnormal behavior includes at least reading and writing of encrypted log files, abnormal execution of operations, and file tampering time.
[0028] In some embodiments, the apparatus further includes:
[0029] Log recording module: Used to record the file name, storage path, detection time, and detection results of the detected data.
[0030] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described above.
[0031] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.
[0032] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the method described above.
[0033] The present invention provides a method and apparatus for detecting malicious code targeting SSH backdoors. It calculates the digest value of the target SSH service file and compares it with the digest value of a pre-stored normal SSH service file to determine if the file has been tampered with; it detects the file type, size, and whether it uses packing techniques to determine if the file is abnormal; and it tracks and monitors the process of the SSH service file to detect any abnormal behavior during the process. This abnormal behavior includes at least reading and writing encrypted log files, abnormal execution operations, and file tampering times. Therefore, it effectively solves the problem of difficult SSH backdoor detection, improves the accuracy and reliability of detection, and can greatly improve the accuracy rate of detecting malicious SSH backdoors. Attached Figure Description
[0034] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0035] Figure 1 This is a flowchart illustrating the malicious code detection method for SSH backdoors provided by the present invention;
[0036] Figure 2 This is a structural block diagram of the SSH associated file integrity detection module provided by the present invention. Detailed Implementation
[0037] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0038] In one specific implementation, such as Figure 1 As shown, the malicious code detection method for SSH backdoors provided by this invention includes the following steps:
[0039] The digest value of the target SSH service file is calculated and compared with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with; in other words, integrity is checked by determining whether the file has been tampered with.
[0040] The file type, size, and whether the SSH service file uses packing technology are detected to determine if the file is abnormal, thereby realizing anomaly detection. Anomaly detection and the aforementioned integrity detection together constitute SSH associated file attribute detection.
[0041] The process of tracking and monitoring SSH service files is used to detect any abnormal behavior during the process. The abnormal behavior includes at least reading and writing encrypted log files, performing abnormal operations, and tampering with file timestamps. In other words, the detection of the SSH process includes detecting reading and writing encrypted log files, detecting abnormal operations, and detecting tampering with file timestamps.
[0042] Overall, addressing the challenges of SSH backdoors' strong concealment and difficulty in detection, this study, based on in-depth reverse engineering of SSH backdoors, extracts their characteristics and examines SSH service-related files (" / usr / bin / ssh" and " / usr / sbin / sshd") from two perspectives: file attributes and process execution. This enables the detection of SSH backdoors on the terminal.
[0043] Research on numerous SSH backdoors revealed differences in file attributes between them and legitimate SSH service files. Firstly, while various SSH protocol tools exist, most systems use the default tool without requiring replacement under normal circumstances. The compiled SSH service files from the same SSH protocol tool on the same system version are identical. However, SSH backdoors, due to the implantation of malicious code, inevitably alter their files. Therefore, we collect legitimate SSH service files, calculate their file digests, and compare them with the digests of the SSH service files being investigated to perform integrity checks and filter out SSH backdoors. Secondly, SSH backdoors are created by attackers adding malicious code to legitimate SSH service files to achieve backdoor functionality. This results in differences in file size, file type, and other file attributes between SSH backdoors and legitimate SSH service files. We can leverage this characteristic to filter out SSH backdoors that differ from legitimate SSH service files by examining their file attributes.
[0044] A normal SSH file only provides SSH remote login functionality, and the processes it runs perform relatively simple operations. However, SSH backdoors, compared to normal SSH files, often support additional functions such as remote control, encrypted SSH login logs, and SSH login record erasure. Their process execution differs significantly from that of a regular SSH file. Based on this characteristic, by tracing the SSH service and monitoring process execution, it's possible to investigate whether SSH-related processes exhibit backdoor behavior (encrypted log file reading and writing, file execution calls, file time modification, etc.).
[0045] The integrity check process determines whether a file has been tampered with, specifically including:
[0046] Collect and store the summary values of normal SSH service files under different system versions;
[0047] The calculated digest value of the target SSH service file is matched with the stored digest value, and the detection result is output.
[0048] If the detection result is a match, the file is determined not to have been tampered with.
[0049] If the detection result is a mismatch, the file is determined to have been tampered with.
[0050] Specifically, such as Figure 2 As shown in Table 1, the detection module used for SSH associated file integrity detection mainly includes four sub-modules:
[0051] 1) SSH Digest Value Storage Submodule: Collects and stores the digest values of normally associated SSH files (" / usr / bin / ssh" and " / usr / sbin / sshd"). It has built-in digest values of 81 different SSH files for different system versions such as Ubuntu, CentOS, and Debian, as well as different SSH protocol tools such as openssh and Dropbear SSH. In addition to the built-in digest values, the module calculates the digest and updates it to the storage module in a timely manner after the SSH file is updated.
[0052] 2) SSH File Digest Calculation Submodule: Calculates the digest value of the target SSH service file.
[0053] 3) SSH File Integrity Detection Submodule: Matches the output of the file digest calculation module with the digest value in the digest storage module, outputs the detection result, and stores the detection result in the log file.
[0054] 4) Log viewing submodule: Users can view log information by time, including the file name of the detected data, storage path, detection time, and detection results.
[0055] Table 1. List of Normal SSH Associated File HASH
[0056] 0f91813f03a016c252cd5be419add664 c674982932331edcd9923559c964fde4 c674982932331edcd9923559c964fde4 ad8ad860599b0eb88836c72cf9b0b494 e93c075d11136673b5521fa29611c399 e3685ac339629857989f508f1eca315e 42b1e695b84ce8b44a8d9a7c28cb10f2 3971e64d05f0c0468cec0798f7fdf301 f02cb198ed94e1b816c90daea4c263f1 2fe5709cf931b320d947854fe019c49a be44c187dd546852451121b7517b1fe4 f6641f1e109d87ce173ee5f4d2fcb8f6 f4190b7209bbf6eed2cb76f7d5b12d7c f196db35c4c2fadde4fea5f02ac57e98 459aa9202d4b4a58a09e91f809652cdc
[0057] The anomaly detection process determines whether a file is abnormal, specifically including:
[0058] Check if the SSH service file is an ELF executable file. If it is, it is a normal file; otherwise, it is an abnormal file.
[0059] Check if the size of the SSH service file is within the normal range. If it is, it is a normal file; otherwise, it is an abnormal file.
[0060] This function checks whether SSH service files are packed or blocked. If so, they are considered abnormal files; otherwise, they are considered normal files.
[0061] Specifically, during the anomaly detection process for SSH association files, under normal circumstances, since the main function of the SSH association files " / usr / bin / ssh" and " / usr / sbin / sshd" is to enable SSH remote login, the SSH association files exhibit a certain degree of stability in file size and status, even across different versions. By collecting a large number of SSH association files, statistically analyzing their file attributes, and identifying patterns, the characteristics of normal SSH association files were discovered:
[0062] ① The file type is an ELF executable file;
[0063] ② The maximum size of " / usr / bin / ssh" is 962KB, and the minimum size is 236KB;
[0064] ③ The maximum size of " / usr / sbin / sshd" is 1.25MB, and the minimum size is 226KB;
[0065] ④ The file is not protected using packing technology.
[0066] Based on the above points, an anomaly detection method for SSH associated files is proposed to detect whether SSH associated files meet the above characteristics.
[0067] The aforementioned process behavior detection specifically includes:
[0068] Detect whether the process running the SSH service file is reading or writing critical SSH log files, and determine whether the log files are encrypted.
[0069] Detect whether the SSH service process is performing any abnormal operations.
[0070] This function checks if any processes running SSH service files have tampered with the file timestamps.
[0071] Furthermore, the methods for detecting malicious code targeting SSH backdoors also include logging functionality, which records the detected filename, storage path, detection time, and detection results.
[0072] Specifically, during the SSH encrypted log file read / write detection process, reverse engineering of SSH backdoors revealed that some SSH backdoors have the function of stealing login information. When an SSH login occurs, the login username and password are encrypted and stored in a designated log file. By tracking and monitoring the processes associated with SSH files (" / usr / bin / ssh" and " / usr / sbin / sshd"), and recording the system calls generated by these processes, the system calls are checked for read / write operations on critical SSH log files.
[0073] For ease of understanding, relevant examples are as follows:
[0074] During SSH login, the system checks the file paths of files read and written, and identifies the system function "open()".
[0075] Table 2 File Read / Write Operation Records
[0076] open(" / usr / share / doc / 0", O_WRONLY|O_CREAT|O_APPEND, 0666) = 4
[0077] The content of the target file is obtained based on the file path, and regular expression matching is used to confirm whether it is an encrypted file.
[0078] Table 3 Regular expressions for matching whether a file is plaintext
[0079] ^[\x20-\x7E\r\n\t]*$
[0080] In detecting abnormal execution operations of SSH associated files, analysis of SSH backdoors reveals that, to enhance their stealth and ensure richer backdoor functionality within a similar file size to normal SSH files, SSH backdoors typically divide themselves into multiple components, each responsible for different functions. When a function is needed, the main execution components (" / usr / bin / ssh" and " / usr / sbin / sshd") invoke and execute it. By tracking and monitoring the processes of the SSH associated files (" / usr / bin / ssh" and " / usr / sbin / sshd"), the system calls generated by these processes are recorded, and the records are used to determine whether the SSH associated files are performing abnormal execution operations.
[0081] For example, a certain backdoor's main execution component is " / usr / sbin / sshd". When it needs to steal login information, it calls the file " / usr / sbin / reporter" using " / usr / sbin / reporter-report user password". By tracking and monitoring the processes associated with the SSH files (" / usr / bin / ssh" and " / usr / sbin / sshd"), and recording the system calls generated by these processes, the system calls can be analyzed based on the string "execve(" / bin / sh") in the system calls to determine if the SSH files are performing abnormal execution operations.
[0082] Table 4 Record of Abnormal Execution Operations
[0083]
[0084] In detecting SSH-associated file time tampering, analysis of SSH backdoors revealed that, to hide their operation logs and prevent security personnel from finding the backdoor-operated files based on time during forensics, SSH backdoors would tamper with the last modification time of file 5 after reading and writing to the file. Normal SSH-associated files, however, almost never modify the file time when reading it. Therefore, this characteristic can be used to identify malicious SSH backdoors.
[0085] By tracing and monitoring the processes associated with SSH (" / usr / bin / ssh" and " / usr / sbin / sshd"), the system calls generated by these processes are recorded. The records are then analyzed based on the system calls...
[0086] The function `utimes()` modifies the file's time, allowing you to determine if an SSH-associated file has undergone a time modification operation. An example is shown below:
[0087] Table 5 Record of document tampering times
[0088]
[0089] In the above specific embodiments, the malicious proxy against SSH backdoors provided by the present invention
[0090] The code detection method calculates the digest value of the target SSH service file and compares it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with; it detects SSH service...
[0091] The system analyzes the file type, size, and whether it uses encryption techniques to determine if the file is abnormal; it also tracks and monitors the SSH service process to detect any abnormal behavior during the process, including at least reading / writing encrypted log files and performing abnormal operations.
[0092] And the file tampering time. This effectively solves the problem of difficult SSH backdoor detection, improves the accuracy and reliability of SSH backdoor detection, and can greatly enhance the accuracy of detecting malicious SSH backdoors.
[0093] Accuracy.
[0094] Specifically, SSH file integrity detection involves calculating the file digest of SSH-associated files, obtaining the digest value of the SSH-associated files, and matching the file digest value with the digest value in the digest storage module to achieve a preliminary check of SSH files.
[0095] SSH Association File Anomaly Detection: This function checks SSH association files by size and status to identify abnormal files. It checks if the SSH association file is an ELF executable; if it uses a packer; and if its size falls within the normal range: " / usr / bin / ssh" should be between 236KB and 962KB; " / usr / sbin / sshd" should be between 226KB and 1.25MB.
[0096] SSH Process Behavior Detection: By tracking and monitoring the processes associated with SSH files (" / usr / bin / ssh" and " / usr / sbin / sshd"), the system calls generated by these processes are recorded. Abnormal behavior in the SSH files within these records is detected to determine if an SSH backdoor exists. Detected abnormal behaviors include: encrypted log file read / write behavior (first, the log file path is obtained by finding the read / write function "open(")" using the characteristic string, and then the operation log file is checked for encryption using the regular expression "^[\x20-\x7E\r\n\t]*$"); abnormal execution behavior (detected by the characteristic string "execve(" / bin / sh"); and file time-tampering behavior (detected by the characteristic string "utimes()").
[0097] This invention is not limited to SSH backdoor detection; it can also be used to detect backdoors through remote control protocols such as RCP and TELNET.
[0098] In addition to the methods described above, the present invention also provides a malicious code detection device for implementing the detection methods described above, the device comprising:
[0099] File integrity detection module: used to calculate the digest value of the target SSH service file and compare it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with;
[0100] The file anomaly detection module is used to detect the file type, size, and whether the SSH service file uses packing technology to determine if the file is abnormal.
[0101] Process behavior detection module: used to track and monitor the process of SSH service files in order to detect whether there is any abnormal behavior during the process. The abnormal behavior includes at least reading and writing of encrypted log files, abnormal execution of operations, and file tampering time.
[0102] In some embodiments, the apparatus further includes:
[0103] Log recording module: Used to record the file name, storage path, detection time, and detection results of the detected data.
[0104] In some embodiments, determining whether a file has been tampered with specifically includes:
[0105] Collect and store the summary values of normal SSH service files under different system versions;
[0106] The calculated digest value of the target SSH service file is matched with the stored digest value, and the detection result is output.
[0107] If the detection result is a match, the file is determined not to have been tampered with.
[0108] If the detection result is a mismatch, the file is determined to have been tampered with.
[0109] In some embodiments, determining whether a file is abnormal specifically includes:
[0110] Check if the SSH service file is an ELF executable file. If it is, it is a normal file; otherwise, it is an abnormal file.
[0111] Check if the size of the SSH service file is within the normal range. If it is, it is a normal file; otherwise, it is an abnormal file.
[0112] This function checks whether SSH service files are packed or blocked. If so, they are considered abnormal files; otherwise, they are considered normal files.
[0113] In some embodiments, process behavior detection specifically includes:
[0114] Detect whether the process running the SSH service file is reading or writing critical SSH log files, and determine whether the log files are encrypted.
[0115] Detect whether the SSH service process is performing any abnormal operations.
[0116] This function checks if any processes running SSH service files have tampered with the file timestamps.
[0117] In some embodiments, the method for detecting malicious code targeting SSH backdoors also includes a logging function to record the detected file name, storage path, detection time, and detection results.
[0118] In the above specific embodiments, the malicious code detection device for SSH backdoors provided by the present invention calculates the digest value of the target SSH service file and compares it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with; it detects the file type, size, and whether the SSH service file uses packing technology attributes to determine whether the file is abnormal; and it tracks and monitors the process of the SSH service file to detect whether there is any abnormal behavior during the process. The abnormal behavior includes at least reading and writing encrypted log files, abnormal execution operations, and file tampering time. This effectively solves the problem of the difficulty in detecting SSH backdoors, improves the accuracy and reliability of detection, and can greatly improve the accuracy rate of detecting malicious SSH backdoors.
[0119] The electronic device provided by this invention may include: a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. The processor can call logical instructions in the memory to execute the method described above.
[0120] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0121] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, the computer program being stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer is able to perform the methods described above.
[0122] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods described above.
[0123] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0124] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for detecting malicious code targeting SSH backdoors, characterized in that, Includes the following steps: Calculate the digest value of the target SSH service file and compare it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with; Detect the file type, size, and whether the SSH service file uses packing techniques to determine if the file is abnormal; The process of tracking and monitoring SSH service files is used to detect any abnormal behavior during the process. Such abnormal behavior includes at least reading and writing encrypted log files, abnormal execution of operations, and tampering with file timestamps.
2. The method for detecting malicious code targeting SSH backdoors according to claim 1, characterized in that, Determining whether a file has been tampered with specifically includes: Collect and store the summary values of normal SSH service files under different system versions; The calculated digest value of the target SSH service file is matched with the stored digest value, and the detection result is output. If the detection result is a match, the file is determined not to have been tampered with. If the detection result is a mismatch, the file is determined to have been tampered with.
3. The malicious code detection method for SSH backdoors according to claim 1, characterized in that, Determining if a file is abnormal includes: Check if the SSH service file is an ELF executable file. If it is, it is a normal file; otherwise, it is an abnormal file. Check if the size of the SSH service file is within the normal range. If it is, it is a normal file; otherwise, it is an abnormal file. This function checks whether SSH service files are packed or blocked. If so, they are considered abnormal files; otherwise, they are considered normal files.
4. The malicious code detection method for SSH backdoors according to claim 1, characterized in that, Process behavior detection specifically includes: Detect whether the process running the SSH service file is reading or writing critical SSH log files, and determine whether the log files are encrypted. Detect whether the SSH service process is performing any abnormal operations. This function checks if any processes running SSH service files have tampered with the file timestamps.
5. The malicious code detection method for SSH backdoors according to claim 1, characterized in that, It also includes a logging function to record the file name, storage path, detection time, and detection results of the detected data.
6. A malicious code detection apparatus for implementing the detection method as described in any one of claims 1-5, characterized in that, The device includes: File integrity detection module: used to calculate the digest value of the target SSH service file and compare it with the digest value of a pre-stored normal SSH service file to determine whether the file has been tampered with; The file anomaly detection module is used to detect the file type, size, and whether the SSH service file uses packing technology to determine whether the file is abnormal. Process behavior detection module: used to track and monitor the process of SSH service files in order to detect whether there is any abnormal behavior during the process. The abnormal behavior includes at least reading and writing of encrypted log files, abnormal execution of operations, and file tampering time.
7. The malicious code detection device according to claim 6, characterized in that, The device further includes: Log recording module: Used to record the file name, storage path, detection time, and detection results of the detection.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.