Script detection method, device, storage medium, and program product

Abstract

Embodiments of the present disclosure provide a script detection method, a device, a storage medium, and a program product. By parsing virtual machine code of a script under detection, taint information is determined, and by simulating the execution of virtual machine operation instructions corresponding to the virtual machine code, a propagation path of the taint information in the script under detection is determined; and on the basis of the propagation path, security detection is performed on the script under detection. By simulating the execution of the virtual machine operation instructions of the script under detection, the propagation process of the taint information can be dynamically observed, avoiding malicious behaviors that are obfuscated or hidden in static analysis. Even if an attacker attempts to bypass a detection system by means of adversarial means executed under certain specific conditions, the dynamic simulation of the execution of the virtual machine code of the script under detection can also simulate execution under these specific conditions, and therefore, malicious behaviors triggered by the attacker under the specific conditions can also be detected. Therefore, the script detection method can reduce the probability of missed detection of dangerous scripts.

Description

Script detection methods, equipment, storage media and program products

[0001] This disclosure claims priority to Chinese Patent Application No. 202510213874.3, filed on February 25, 2025 with the China National Intellectual Property Administration, entitled “Script Detection Method, Device, Storage Medium and Program Product”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This disclosure relates to the field of computer technology, and in particular to a script detection method, device, storage medium, and program product. Background Technology

[0003] Malicious scripts are a common cyberattack method, widely used by attackers to control servers, steal data, or launch further attacks. Traditional malicious script detection methods are mainly divided into two categories: static detection and dynamic detection. Static detection methods identify malicious scripts through rule matching, signature-based methods, or statistical features, while dynamic detection methods rely on sandboxing techniques or log analysis to detect script behavior and thus identify malicious scripts.

[0004] However, as attack methods continue to evolve, their limitations are becoming increasingly apparent. Static rule engines struggle to cope with encryption, obfuscation, and other adversarial techniques, leading to missed detections of dangerous scripts. While dynamic sandbox engines monitor code behavior in an isolated environment, attackers can bypass the sandbox through conditional branches or environment checks, or trigger malicious behavior based on specific external inputs. Furthermore, the dynamic sandbox engine's ability to detect conditional branch adversarial techniques or malicious behavior triggered by specific external inputs also results in serious missed detections. Summary of the Invention

[0005] This disclosure provides a script detection method, apparatus, storage medium, and program product to reduce the probability of missing dangerous scripts.

[0006] In a first aspect, embodiments of this disclosure provide a script detection method, including:

[0007] In response to a script detection request, the script to be tested is compiled into virtual machine code;

[0008] The virtual machine code is parsed to determine taint information within it.

[0009] The virtual machine code is parsed into virtual machine operation instructions;

[0010] Simulate the execution of the virtual machine operation instructions to determine the propagation path of the taint information in the script under test;

[0011] The security of the script under test is determined based on the propagation path.

[0012] Secondly, this disclosure also provides a script detection method, including:

[0013] In response to a request to invoke a target service, the processing resources corresponding to the target service are determined; the target service refers to a service that provides script detection.

[0014] The steps in the script detection method provided in the first aspect above are executed using the processing resources corresponding to the target service.

[0015] Thirdly, embodiments of this disclosure also provide an electronic device, including: a memory and a processor; wherein the memory is used to store a computer program;

[0016] The processor is coupled to the memory and is used to execute the computer program to perform the steps in the above-described script detection methods.

[0017] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps in the script detection methods described above.

[0018] Fifthly, embodiments of this disclosure also provide a computer program product, including a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the script detection methods described above.

[0019] In this embodiment, the script under test is compiled into virtual machine code. Tainted information is identified by parsing the virtual machine code, and the propagation path of the tainted information in the script under test is determined by simulating the execution of the virtual machine operation instructions corresponding to the virtual machine code. Based on the propagation path, security testing is performed on the script under test. By simulating the execution of the virtual machine operation instructions of the script under test, the propagation process of tainted information can be dynamically observed, avoiding malicious behaviors that are obscured or hidden in static analysis. Even if an attacker attempts to bypass the detection system using adversarial methods executed under specific conditions, the execution under these specific conditions can be simulated by dynamically simulating the execution of the virtual machine code of the script under test. Therefore, malicious behaviors triggered by the attacker under specific conditions can also be detected. Thus, this script detection method can reduce the probability of missing dangerous scripts. Attached Figure Description

[0020] The accompanying drawings, which are included to provide a further understanding of this disclosure and form part of this disclosure, illustrate exemplary embodiments of the present disclosure and are used to explain the disclosure, but do not constitute an undue limitation of the disclosure. In the drawings:

[0021] Figure 1 is a flowchart illustrating the script detection method provided in this embodiment of the present disclosure;

[0022] Figure 2 is a schematic diagram of the architecture of the script detection system provided in an embodiment of this disclosure;

[0023] Figure 3 is a flowchart of the traditional script detection method;

[0024] Figure 4 is a schematic diagram of the script detection process provided in an embodiment of this disclosure;

[0025] Figure 5 is a flowchart illustrating another script detection method provided in an embodiment of this disclosure;

[0026] Figure 6 is a schematic diagram of the structure of the electronic device provided in the embodiment of this disclosure. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of this disclosure clearer, the technical solutions of this disclosure will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0028] It should be noted that, in the cases involving user information in the embodiments of this disclosure, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse.

[0029] The terms and concepts involved in the embodiments of this disclosure will be explained below.

[0030] Webshell (a type of malicious script): A webshell is a malicious World Wide Web (WWW) application that hackers typically use to illegally access and control a victim's server or website. A webshell is usually a simple script file (such as PHP, ASP, or JSP) that can be uploaded to the victim's server over the network. Once successfully uploaded, the attacker can use the webshell to remotely execute commands, upload or download files, steal data, and so on.

[0031] Simulated Execution & Taint Analysis (STA) Engine: STA is a security analysis tool primarily used to track and analyze data flow within applications, especially in detecting potential security vulnerabilities. It identifies potentially malicious parts of an application by simulating the propagation and transformation of "tainted" data.

[0032] Taints: Taints refer to untrusted data or input operations. This data may originate from external sources (such as user input, file reads, network requests, etc.) and may contain malicious content. Tainted data needs to be verified or cleaned before it can be used safely; otherwise, it may lead to various security problems, such as Structured Query Language (SQL) injection, cross-site scripting attacks, or command injection.

[0033] Taint Source: A taint source is a location in a program where untrusted data is introduced. This data typically originates from external input or other untrusted sources and may pose a security risk if used directly without verification or cleanup. The data source is usually external, such as user input, file systems, or network communications. This data is marked as "tainted" upon entering the system to indicate that its security requires special attention during subsequent processing.

[0034] A sink is an operation in a program that may pose a security risk, especially those operations that directly pass data to system calls, database queries, file operations, or other sensitive functions. If tainted data reaches the sink without proper validation or cleanup, it can lead to various security problems. Sinks are where critical operations such as database queries, file writes, and command execution are performed. Failure to properly validate or clean up tainted data can result in serious security vulnerabilities.

[0035] Abstract Syntax Tree (AST): An abstract syntax tree is a tree-like data structure used to represent the structure of program source code. It is widely used in compiler principles and the parsing process of various languages. It extracts higher-level syntactic structures from the source code, removing unnecessary details (such as parentheses and other syntax symbols), making the semantic structure of the program clearer.

[0036] Virtual Machine Code (VMC): VMC typically refers to intermediate code or bytecode used in virtual machines. This code is not written directly for specific hardware, but rather for the design of an abstract computer architecture (virtual machine). The concept of VMC can be seen in many programming languages ​​and runtime environments; typical examples include Java bytecode, .NET's Common Intermediate Language (CIL), and many other virtual machine-related technologies.

[0037] Branching attack: Branching attack is an adversarial attack technique that exploits vulnerabilities in program branching logic. Attackers construct specific input data to make the program execute specific branch paths, thereby bypassing detection logic or triggering unexpected behavior.

[0038] The adversarial capability of a script detection system measures its ability to resist adversarial attacks. High adversarial capability means that the system can still maintain efficient and accurate detection even when faced with carefully designed or modified dangerous scripts (i.e., adversarial samples) designed to evade detection. Specifically, adversarial capability refers to the detection system's ability to resist various evasion techniques, ensuring that even if dangerous scripts use obfuscation, encryption, or polymorphism, the script detection system can still identify and defend against these threats. Therefore, improving the adversarial capability of a script detection system can enhance its ability to identify dangerous scripts, thereby reducing the probability of missing dangerous scripts. Dangerous scripts are scripts that pose a risk of attack or information theft; they can also be called malicious scripts.

[0039] In some embodiments of this disclosure, to enhance the adversarial nature of script detection, the script under test is compiled into virtual machine code. Tainted information is identified by parsing the virtual machine code, and the propagation path of the tainted information in the script under test is determined by simulating the execution of the virtual machine operation instructions corresponding to the virtual machine code. Based on the propagation path, security detection is performed on the script under test. By simulating the execution of the virtual machine operation instructions of the script under test, the propagation process of tainted information can be dynamically observed, avoiding malicious behaviors that are obscured or hidden in static analysis. Even if an attacker attempts to bypass the detection system using adversarial methods executed under specific conditions, dynamically simulating the execution of the virtual machine code of the script under test, these executions under specific conditions can be simulated. Therefore, malicious behaviors triggered by the attacker under specific conditions can also be detected. In summary, the script detection method provided by the embodiments of this disclosure has strong adversarial capabilities, helping to reduce the probability of missing dangerous scripts.

[0040] The technical solutions provided by the embodiments of this disclosure are described in detail below with reference to the accompanying drawings.

[0041] It should be noted that the same reference numerals in the following figures and embodiments denote the same object or the same step. Therefore, once an object or step is defined in one figure or embodiment, it does not need to be discussed further in subsequent figures and embodiments.

[0042] Figure 1 is a flowchart illustrating the script detection method provided in this embodiment. As shown in Figure 1, the script detection method mainly includes the following steps:

[0043] 101. In response to the script detection request, compile the script to be tested into virtual machine code.

[0044] 102. Parse the virtual machine code to identify taint information in the virtual machine code.

[0045] 103. Parse the virtual machine code into virtual machine operation instructions.

[0046] 104. Simulate the execution of virtual machine operation instructions to determine the propagation path of taint information in the script under test.

[0047] 105. Determine the security of the script under test based on the propagation path.

[0048] In this embodiment of the disclosure, the script to be tested refers to the script to be subjected to security testing. The script detection method provided in this embodiment of the disclosure is applicable to script detection in any programming language, that is, the script to be tested can be a script written in any programming language, as shown in Figure 2 "Programming Language Support Layer". The programming language can be JSP, PHP, ASP, ASP.NET or Python (not shown in Figure 2), etc.

[0049] The script detection request can be automatically triggered by the script detection system or triggered by a user and received by the system. In some embodiments, the script detection system periodically loads the script to be tested from a pre-set storage address and performs script detection according to a set script detection cycle. In this case, the script detection request is implemented as an automatically triggered script detection request when the script detection cycle arrives. In other embodiments, the user can send a script detection request to the script detection system through their electronic device. This script detection request may carry the script to be tested, or the storage address of the script to be tested, etc. Accordingly, in response to the script detection request, the script to be tested can be loaded from the corresponding storage address.

[0050] After obtaining the script to be tested, the script detection system can initiate security checks on the script. Specifically, in step 101, in response to the script detection request, the script to be tested can be compiled into Virtual Machine Code (VMC). Virtual Machine Code is an Intermediate Representation (IR), which is a set of instructions executed by a Virtual Machine (VM). Virtual Machine Code is a hardware platform-independent intermediate representation and can be executed on different operating systems and hardware architectures. After compiling the script to be tested into Virtual Machine Code, the specific implementation details of the script are abstracted, making it difficult for attackers to bypass the detection by directly modifying the script's code.

[0051] The implementation of virtual machine code differs depending on the programming language. For Java, the virtual machine code is called bytecode and is stored in class files (.class files). For C#, the virtual machine code is called Intermediate Language (IL) and is stored in dynamic link library (DLL) files (.dll) or executable (EXE) files. For PHP, the virtual machine code is called bytecode and is stored in .hhbc files; and so on. A .hhbc file is a binary file used to store the compiled PHP bytecode. It contains all the information needed by the virtual machine to execute the program at runtime, including bytecode, metadata, and other auxiliary information.

[0052] The virtual machine in this disclosure refers to a process virtual machine, which is a virtual machine designed to achieve cross-platform compatibility of programming languages ​​and run applications developed using those languages. It is specifically designed for executing virtual machine code. For example, the Java Virtual Machine (JVM) corresponds to the Java language. The JVM is one of the core components of the Java platform; it is a virtual computer capable of executing Java bytecode. By simulating various computer functions on a real computer, the JVM enables Java programs to run on different operating systems and hardware platforms without modification. Another example is the PHP Virtual Machine, which corresponds to the PHP language. The PHP Virtual Machine refers to the runtime environment used when executing PHP code; it is responsible for converting PHP source code into executable instructions and running those instructions; and so on.

[0053] Specifically, in response to a script detection request, the target programming language of the script under test can be determined. Then, the native compiler corresponding to the target programming language is invoked to compile the script under test into virtual machine code. Here, the native compiler refers to a compiler that provides a native compilation environment or ecosystem for the target programming language. Of course, in some embodiments, in response to a script detection request, a self-developed compiler can also be used to compile the script under test into virtual machine code. Using a native compiler to compile the script under test into virtual machine code is mainly because a native compiler can provide a native compilation environment or ecosystem for the target programming language, automatically adding some code corresponding to the native compilation environment of the target programming language during the compilation of the script under test. Attackers may exploit this code to bypass the script detection system. The inventors of this disclosure have researched traditional schemes for code analysis of scripts under test to achieve dangerous script detection. The main process of script detection in this traditional scheme is shown in Figure 3, and mainly includes the following steps:

[0054] 1. Lexical and Syntactic Analysis: Lexical and syntactic analysis is performed on the script under test to obtain its Abstract Syntax Tree (AST). Specifically, the script is decomposed into meaningful segments called tokens. Tokens include keywords, identifiers, operators, delimiters, etc. Then, according to the grammatical rules of the language, the token sequence is organized into an AST.

[0055] 2. Simulated executor traversal of AST: Based on the AST, the script under test is simulated and executed. During the simulated execution of the script under test, taint information in the script under test is identified, and the propagation path of taint information in the script under test is traced.

[0056] 3. Based on the propagation path, determine whether the tainted information has propagated to the sink. If the result is yes, the script under test is determined to be a dangerous script; if the result is no, the script under test is determined to be a safe script.

[0057] The inventors of this disclosure, through their research on the aforementioned traditional script detection methods, discovered that the script under test is actually executed through a virtual machine corresponding to the target programming language. When the virtual machine executes the script, it adds some native environment code of the target programming language to the script. Attackers may exploit this automatically added code to evade script detection systems. The following example uses Java as an illustration. The Java script under test is in JSP format.

[0058] One reason why traditional AST-based script detection methods have missed detection issues is: For example, suppose we consider a JSP webshell script:

[0059] try{

[0060] Runtime.getRuntime().exec(data);

[0061] The above is a JSP webshell sample that runs normally on the JVM, but from a lexical and syntactic perspective, it is completely illegal because the statements in the script are not closed and the code is incomplete. However, when the JVM compiles the script, it adds its own framework code. As long as the script can make good use of the framework code structure, it can run normally. However, traditional AST-based script detection methods, when performing lexical and syntactic analysis, determine that the script is incomplete, meaning it cannot run. Therefore, they consider the script risk-free and allow it to run. However, the script above executes arbitrary data, posing a security risk. Therefore, the traditional AST-based script detection method cannot accurately and completely understand malicious code, resulting in serious missed detections.

[0062] The second reason for the missed detection problem in traditional AST-based script detection methods is that the inventors of this disclosure have also discovered that when the virtual machine executes the script under test, it first converts the script into a source code file, and then compiles the source code file into virtual machine code. For example, for JSP scripts, before executing the JSP script, the virtual machine first compiles it into a Java file (the source code file corresponding to the Java language), and finally compiles it into a bytecode file (i.e., a Class file). The Class file is the virtual machine code corresponding to the Java language. Implicit code is relative to the code executed by the virtual machine. Among them, the literal code reflected in the script is explicit code. However, due to different syntax characteristics, the code added by default by the virtual machine during execution is implicit code. For example, for a script that uses the try-with-resources syntax, the Java Virtual Machine will automatically call the Close method of the AutoCloseable implementation class, thereby triggering the Close method of XMLDecoder.

[0063] AutoCloseable is an interface in Java that defines a single method, the Close method, for releasing resources. Any class that implements the AutoCloseable interface can be used in Java's try-with-resources statement, making resource management simpler and safer because resources are automatically closed when the try block ends, even in the event of an exception. The try block is a structure in programming languages ​​used for exception handling. It allows you to attempt to execute a piece of code, and if an exception (i.e., an error or unexpected situation) occurs during execution, you can define how to handle the exception instead of crashing the entire program.

[0064] The try-with-resources statement is a new exception handling mechanism introduced in Java 7, designed to simplify resource management, especially for resources that must be explicitly closed, such as files and database connections. This mechanism ensures that resources are automatically and safely closed after use, thus avoiding the risk of resource leaks.

[0065] XMLDecoder is a Java class used to decode Extensible Markup Language (XML) data streams to reconstruct Java objects. After processing XML data with XMLDecoder, its Close method should be called to close the stream and release associated resources. The Close method is an important method of the XMLDecoder class used to close the input stream associated with the decoder. This method should be called when you have finished decoding the XML data and no longer need the XMLDecoder instance.

[0066] However, the aforementioned Close method is precisely the key to triggering the vulnerability exploit. However, the script detection method based on AST only analyzes the script under test from the explicit lexical and syntactic level, neglecting the implicit code automatically added by the virtual machine. This leads to missed security checks on implicit code, resulting in serious false negatives and missed detections.

[0067] To address the issue of missed detections of potentially dangerous scripts due to the virtual machine automatically adding code during script execution by the target programming language, some embodiments of this disclosure call the native compiler corresponding to the target programming language to compile the script into virtual machine code. Since the native compiler provides the native compilation environment or ecosystem for the target programming language, it automatically adds this code to support the native environment during script compilation.

[0068] The following section details the process of using the native compiler to compile the script under test into virtual machine code. As shown in Figure 2's "Underlying Language Support Layer" under "Native Compiler" and Figure 4's "Native Compiler," the native compiler can be invoked to add framework code supporting the target programming language to the script under test, thus obtaining the corresponding source code file. Framework code typically refers to a pre-written basic code structure designed to implement a specific function or meet certain requirements.

[0069] Furthermore, the source code file can be compiled using a native compiler to obtain Virtual Machine Code (VMC). Since the native compiler automatically adds corresponding framework code to the script under test when compiling it into VMC, the VMC will run correctly during subsequent simulated execution. This script detection method will therefore avoid allowing dangerous scripts to run due to incomplete syntax. Thus, it improves the ability of this script detection method to identify and understand dangerous scripts, thereby reducing the probability of missing dangerous scripts.

[0070] Furthermore, in some embodiments, during the compilation process of the native compiler for the script under test, default implicit code can be added to the script under test; and the script under test with the added implicit code can then be compiled into virtual machine code. Since the compilation environment has already added the default implicit code to the script under test before generating the virtual machine code, the virtual machine code corresponding to the implicit code will also be simulated during subsequent simulation execution of the virtual machine code. In this way, if the implicit code poses an attack risk, it can also be detected, thereby reducing the probability of missing dangerous scripts.

[0071] After obtaining the virtual machine code of the script to be tested, in step 102, the virtual machine code can be parsed to determine the taint information in the virtual machine code.

[0072] Tainted information refers to unverified or untrusted data. This data may originate from external inputs, such as user input, network requests, and file reads, or it may come from untrusted sources within the system. If a program directly uses this unprocessed data for operations, especially for control flow decisions or output generation, it may lead to security vulnerabilities such as SQL injection, cross-site scripting (XSS), or command injection.

[0073] In some embodiments, taint source analysis can be performed on the virtual machine code to identify taint sources within the virtual machine code. A taint source refers to a location in the target application where untrusted or confidential data is introduced. A taint source may include: the location in the target application corresponding to user input, network requests, file reads, or any other input operation that may contain untrusted data. Specifically, as shown in Figures 2 and 4, “VMC Parser,” a virtual code parser (VMC parser) developed using the target programming language (such as Java) of the script under test can be used to perform taint source analysis on the virtual machine code to identify taint sources within the virtual machine code. By using a VMC parser developed using the target programming language of the script under test, the script can be parsed, and taint source analysis of the virtual machine code can be performed using the native code environment corresponding to the target programming language, reducing the development cost of the code environment for the target programming language.

[0074] In some embodiments, taint sources can be specified by the user. Optionally, the virtual machine code can be parsed to determine external input data and / or external input operations contained in the virtual machine code, and from the external input data and / or external input operations, specified external input data and / or external input operations can be determined as taint sources. Alternatively, in some embodiments, external input data and / or external input operations parsed from the virtual machine code can be determined as taint sources.

[0075] Furthermore, information introduced into the virtual machine code by taint sources can be identified as taint information. By identifying taint sources and determining taint information, taints can be traced from their source, allowing for more accurate location of the propagation path of taint information and reducing false positives and false negatives.

[0076] In other embodiments, the virtual machine code can be directly parsed, and external input data and / or external input operations contained in the parsed virtual machine code file can be determined as taint information. Parsing taint information from the virtual machine code provides a tracing object for subsequent tracking of the propagation path of taint information in the script under test.

[0077] Because taint analysis is primarily used to analyze whether tainted information introduced by a taint source can propagate directly to the taint sink without proper cleansing. The taint sink refers to the location in the target application where a security-sensitive operation or an operation that leaks private data to the outside world can directly occur. If the tainted information introduced by the taint source can propagate directly to the taint sink without proper cleansing, it indicates that the target application has issues such as privacy data leakage or dangerous data operations, and a security vulnerability exists. If the tainted information introduced by the taint source cannot propagate directly to the taint sink, or cannot propagate directly to the taint sink without proper cleansing, it indicates that the data flow from the taint source in the target application is secure and there is no security vulnerability. For example, if data carrying tainted information is used for SQL queries, system commands, network responses, or file write operations, and the data reaches the sink without proper cleansing or verification, it may constitute a security vulnerability. Therefore, in step 103, the virtual machine code can be parsed into virtual machine operation instructions. Virtual machine operation instructions refer to instructions executed in the virtual machine corresponding to the target programming language. Virtual machine operation instructions may include opcodes and operands. The opcode indicates the operation to be performed by the instruction, i.e., the function of the instruction; the operands indicate the objects involved in the operation and the location where the result is stored.

[0078] In some embodiments, a virtual code parser (VMC parser) developed using the target programming language (such as Java) of the script under test can be used to parse the virtual machine code into virtual machine operation instructions. The VMC parser, developed using the target programming language of the script under test, can utilize the native code environment corresponding to the script to parse the virtual machine code, thereby improving the accuracy and completeness of the code understanding.

[0079] Furthermore, in step 104, virtual machine operation instructions can be simulated to determine the propagation path of taint information in the script under test. Specifically, the virtual machine operation instructions can be simulated to execute based on the opcodes and operands contained in the virtual machine operation instructions; and during the simulation execution, taint information is tracked to determine the propagation path of taint information in the script under test.

[0080] In some embodiments, as shown in Figures 2 and 4, “Emulator”, an emulator developed using the target programming language (such as Java) of the script under test can simulate the execution of virtual machine operation instructions. Specifically, an emulator developed using the same programming language as the script under test simulates the execution of machine code, allowing direct use of the native language environment without needing to develop or simulate the built-in classes and function libraries of the native programming language (the programming language used by the script under test), thus reducing the development cost of the emulator.

[0081] Specifically, a simulator developed based on the native programming language of the script under test can obtain the target method corresponding to the opcode through reflection. Reflection is the ability of a program to inspect, analyze, and even modify its own structure and behavior at runtime. It allows programs to dynamically obtain and manipulate information such as classes, methods, and attributes without needing to know this information in advance at compile time. Obtaining the target method corresponding to the opcode through reflection, without developing or simulating the built-in classes and function libraries of the native programming language (the programming language used by the script under test), reduces the development cost of the simulator. On the other hand, the built-in classes and function libraries of native programming languages ​​have a large number of classes and functions with varied syntax features, making it difficult to exhaustively enumerate them when simulating them. Attackers often exploit the syntax features of unsimulated classes or functions to evade detection, resulting in the failure to detect malicious scripts. This embodiment uses reflection to dynamically obtain the method corresponding to the opcode during the simulated execution of virtual machine operation instructions. It does not require simulating the built-in classes and function libraries of the native programming language. Attackers cannot use the syntax features of unsimulated classes or functions to evade detection. Therefore, dynamically obtaining the method corresponding to the opcode through reflection can improve the adversarial nature of the script inspection system and reduce the probability of missing dangerous scripts.

[0082] Based on the target method corresponding to the opcode obtained through reflection, the operands corresponding to the virtual machine operation instructions can be passed to the target method, and the target method can be simulated for execution, thereby simulating the execution of the virtual machine operation instructions. Specifically, the virtual machine corresponding to the target programming language can be used to execute the target method, thus simulating the execution of the target method.

[0083] In other embodiments, virtual machine operation instructions can be executed using a virtual machine corresponding to the target programming language to simulate the execution of virtual machine operation instructions. Accordingly, monitoring code is inserted into the virtual machine using an instrumentation tool. The monitoring code monitors the execution process of the virtual machine operation instructions and tracks the propagation path of taint information to obtain the propagation path of taint information.

[0084] Accordingly, during the simulated execution of virtual machine operation instructions, taint information can be tracked to determine the propagation path of taint information in the script under test. In some embodiments, during the simulated execution of virtual machine operation instructions, the explicit flow path of taint information in the script under test can be tracked to obtain the propagation path of taint information in the script under test.

[0085] In some embodiments, as shown in the "Variable Scope Pollution Mechanism" of the "Taint Analysis Inference Layer" in Figure 2, if the taint information is a variable, then within the variable's scope, the explicit flow path of the taint information corresponding to that variable in the script under test can be tracked to determine the propagation path of the taint information in the script under test. Tracking the propagation path of the taint information corresponding to the variable within the variable's scope ensures that the determined propagation path matches the variable's scope, thus improving the accuracy of the determined propagation path. This is because, for a variable, the same variable character represents different variables outside the variable's scope.

[0086] However, the inventors of this disclosure have discovered that taint information frequently experiences "chain breaks" during its flow within the script under test, meaning that the taint information, after reaching a certain point, either no longer appears or disappears. Among these, taint transfer is a scenario where chain breaks are particularly likely to occur during taint propagation. During application runtime, the data represented by the taint (such as private data / externally controllable input data) may propagate through the program in different forms; this transformation is called taint transfer. Typically, taint transfer is caused by calls to certain methods within the script under test. For example, consider a call to any object method, as shown in the example code:

[0087] result=obj.func(arg1,arg2,…argN)

[0088] Here, obj.func() represents the object method being called, result represents the execution result of the object method, and arg1, arg2, ..., argN represent the N input parameters passed to the object method.

[0089] During the invocation of the aforementioned object methods, taint transfer scenarios mainly include:

[0090] Scenario 1: Transferring taint information from an object to the execution result, as shown in the code example below:

[0091] private StringBuilder taintBuilder=new StringBuilder();

[0092] public String obj_2_result(){

[0093] return taintBuilder.toString();

[0094] }

[0095] In the example code above, a private StringBuilder object named taintBuilder is initialized to an empty string, and the object method obj_2_result() returns a String value converted from the taintBuilder object. This object method has no parameters but has a return value; when the StringBuilder object carries taint information, the taint information can be transferred from the StringBuilder object to the returned execution result.

[0096] Scenario 2: Impurity information is transferred from input parameters to execution results. Example code is as follows:

[0097] public String arg_2_result(String taint){

[0098] return taint;

[0099] }

[0100] In the example code above, the public method named `arg_2_result` accepts a String parameter named `taint`. Inside the method body, the input `taint` parameter is directly returned as the result. When the `taint` parameter carries taint information, the taint information can be transferred from the parameter to the returned execution result.

[0101] Scenario 3: Impurity information is transferred from input parameters to an object. Example code is as follows:

[0102] public void arg_2_obj(Stringtaint){

[0103] taintBuilder.append(taint);

[0104] }

[0105] In the example code above, a public method named `arg_2_obj` is defined. This method does not return any value (void) and accepts a String input parameter named `taint`. Inside the method body, the `append` method of the `taintBuilder` property is called, passing `taint` as the parameter. The `append` method appends the string `taint` to the current content of the `taintBuilder` property, thereby modifying the state of the `taintBuilder` property. The main function of this method is to append the externally passed-in `taint` string to the `taintBuilder` property of the object `arg_2_obj`, and it does not return a result. Therefore, when the passed-in parameter `taint` carries taint information, the taint information can be transferred from the input parameter `taint` to the object `arg_2_obj`.

[0106] Scenario 4: Transferring taint information from the object to the input parameter, as shown in the example code below:

[0107] public void obj_2_arg(StringBuilder stringBuilder){

[0108] StringBuilder.append(taintBuilder.toString());

[0109] }

[0110] In the example code above, a public method named `obj_2_arg` is defined. This method does not return any value (void) and accepts a parameter of type `StringBuilder`, named `stringBuilder`. Inside the `obj_2_arg` method body, the `append` method of the `StringBuilder` object is called. It retrieves the content of the `taintBuilder` object using `taintBuilder.toString()`, converts it to a `String` type, and then appends this converted string to the current content of the `stringBuilder` parameter, thereby modifying the state of the `stringBuilder` parameter. This method has no return value. When the `taintBuilder` object carries taint information, the taint information is transferred from the `taintBuilder` object to the `stringBuilder` parameter.

[0111] Scenario 5: Transferring taint information from one input parameter to another, with example code as follows:

[0112] public void arg_2_arg(Stringtaint,StringBuilder stringBuilder){

[0113] stringBuilder.append(taint)

[0114] }

[0115] In the example code above, a public method named `arg_2_arg` is defined. This method does not return any value (void) and accepts two parameters: a `String` variable `taint` and a `StringBuilder` variable `stringBuilder`. Inside the method body, the `append` method of the `stringBuilder` object is called to append new string content to the `stringBuilder`, where the new string content is provided by `taint`. Therefore, when the parameter `taint` carries taint information, the taint information is transferred to the other parameter, `stringBuilder`.

[0116] In the aforementioned taint transfer scenarios, when the object method has a return value, the transfer of taint information is explicit. When the taint information is transferred to the execution result, the flow path of the taint information can be traced by tracking the execution result returned by the object method. When the object method does not have a return value, the transfer of taint information is implicit, allowing the taint information to be passed to other elements that can be used during the execution of the script under test, thus continuously tracking the taint information. Tracking the transfer of taint information between different elements in the script under test can primarily manifest in at least one of the following operations: variable assignment, parameter passing, function calls, control flow branching, array access, and object member access.

[0117] Based on the above analysis, taint information can be tracked during the simulated execution of virtual machine operation instructions to determine the initial propagation path of the taint information in the script under test and the target element to which the taint information is transferred. The initial propagation path refers to the explicit propagation path of the taint information in the script under test. Specifically, the transfer of taint information between different elements in the script under test can be tracked to determine the target element to which the taint information is transferred.

[0118] Specifically, in some embodiments, taint information is a variable, as shown in the "Variable Scope Pollution Mechanism" of the "Taint Analysis Inference Layer" in Figure 2. Within the variable's scope, the explicit flow path of the taint information corresponding to that variable in the script under test can be tracked to determine the initial propagation path of the taint information in the script under test. Tracking the propagation path of the taint information corresponding to the variable within the variable's scope ensures that the determined propagation path matches the variable's scope, improving the accuracy of the determined propagation path. This is because, for a variable, the same variable character represents different variables outside the variable's scope.

[0119] Next, the target element can be tracked to determine the transfer path of taint information. The transfer path of taint information can be understood as the propagation path of the target element in the script under test. If the target element is a variable, it can also be tracked within the scope of that variable to determine the propagation path of the target element in the script under test, and the propagation path of the target element in the script under test can be used as the transfer path of taint information.

[0120] Furthermore, the propagation path of tainted information in the script under test can be determined based on the initial propagation path and the transfer path. In this embodiment, by tracking the target element to which the tainted information is transferred, the implicit propagation path of the tainted information in the script under test can be supplemented, thereby improving the completeness of the determined propagation path of the tainted information. This helps to improve the accuracy of subsequent determination of whether the tainted information flows into the convergence point, and can further increase the probability of dangerous scripts being detected, i.e., reduce the probability of dangerous scripts being missed.

[0121] In some embodiments, the initial propagation path and transfer path of tainted information can be determined as the propagation path of the tainted information in the script under test. In other embodiments, potential propagation paths of tainted information can also be mined. Specifically, potential propagation paths of tainted information can be mined based on the initial propagation path, transfer path, and virtual machine operation instructions to obtain potential propagation paths. Further, the initial propagation path, transfer path, and potential propagation path can be determined as the propagation path of the tainted information in the script under test. By mining potential propagation paths of tainted information, the propagation path of tainted information in the script under test can be further improved, reducing the possibility of tainted information escaping or hiding, and helping to further reduce the probability of dangerous scripts being missed.

[0122] The following is an example illustrating the specific implementation of mining potential propagation paths for taint information.

[0123] In some embodiments, as shown in the "Conditional Expression Indirect Pollution Mechanism" of the "Taint Analysis Inference Layer" in Figure 2, for conditional expressions, such as if-else conditional expressions, if some conditional branches of the conditional expression are polluted, that is, taint information flows into some conditional branches of the conditional expression, then it can be considered that other conditional branches of the conditional expression are indirectly polluted. This prevents attackers from using conditional branches to bypass or circumvent script detection system checks, and reduces the risk of dangerous scripts being missed. Based on this, the virtual machine operation instruction set corresponding to the initial propagation path (defined as the first virtual machine operation instruction set) and the virtual machine operation instruction set corresponding to the transfer path (defined as the second virtual machine operation instruction set) can be obtained from the virtual machine operation instructions. Further, if conditional expressions exist in the first and second virtual machine operation instruction sets, and if the initial propagation path and / or transfer path do not include all conditional branches of the conditional expression, then the conditional branches not included in the initial propagation path and / or transfer path are identified as potential propagation paths for taint information.

[0124] In other embodiments, as shown in the "Uncertainty Value Inference Mechanism" of the "Taint Analysis Inference Layer" in Figure 2, for selection statements, such as the Switch selection statement, if the specific branch executed by the selection statement depends on the input of the selection statement, taint information may flow into any branch of the selection statement during actual execution. Therefore, to minimize the probability of the taint information propagation path being missed in the statistics, all branches of the selection statement can be simulated to determine whether the taint information or target element flows into the selection statement or a branch of the selection statement. In this embodiment, for ease of description, the selection statement whose value determines the branch actually running is defined as the target selection statement. Accordingly, if a target selection statement exists in the first virtual machine operation instruction set and the second virtual machine operation instruction set, all branches of the target selection statement are simulated, and the propagation paths of the taint information and target element in all branches of the target selection statement are obtained based on their propagation paths. Furthermore, the propagation paths of the taint information and target element in all branches of the target selection statement can be determined as the potential propagation paths of the taint information in the script under test. This implementation method simulates the execution of all branches of the target selection statement to determine the propagation path of taint information and target elements in the target selection statement. It can deeply explore the propagation path of taint information, improve the propagation path of taint information, and thus help reduce the risk of dangerous scripts being missed.

[0125] In other embodiments, for certain input / output (IO) operations, such as writing a variable to a file during the flow of the script under test, and then not using that variable again, but instead using another variable to read the file, this can also lead to a break in the taint information chain. During the tracing of this variable, the tracing chain ends after the variable's propagation path is written to the file. If an attacker subsequently uses another variable to read the file, it will also lead to the propagation of the taint information. To enable the script detection system to still detect this situation, the "IO indirect propagation heuristic mechanism" shown in Figure 2 can be used to mine the propagation path of the taint information.

[0126] Specifically, when the taint information and / or target element includes a second variable, the first virtual machine operation instruction set corresponding to the initial propagation path and the second virtual machine operation instruction set corresponding to the transfer path can be obtained from the virtual machine operation instructions. If there is a write instruction for the second variable in the first virtual machine operation instruction set and the second virtual machine operation instruction set, the identifier of the file to be written by the write instruction is obtained from the virtual machine operation instructions. If there is a read instruction for the file identifier in the virtual machine operation instructions, the flow path from the write instruction to the read instruction is determined as the potential propagation path of the taint information. This implementation can mine the propagation path of taint information through the I / O indirect transmission heuristic mechanism, prevent the script under test from using I / O operations to bypass the script detection system, improve the adversarial nature of script detection, and thus help reduce the probability of missing dangerous scripts.

[0127] The methods for mining potential propagation paths of tainted information illustrated in the foregoing embodiments are merely illustrative and do not constitute a limitation. Furthermore, the initial propagation path, the transfer path, and the potential propagation path of tainted information can be determined as the propagation path of tainted information, thereby refining the propagation path of tainted information and helping to reduce the probability of missed detection of dangerous scripts.

[0128] Furthermore, in step 105, the security of the script under test can be determined based on the propagation path of the taint information. Specifically, as shown in Figure 4, it can be determined whether the taint information has propagated to a preset convergence point based on the propagation path; if the determination result is yes, the script under test can be determined to be a dangerous script. Correspondingly, if the taint information has not propagated to the preset convergence point, the script under test can be determined to be a safe script.

[0129] In this embodiment, the script under test is compiled into virtual machine code. Tainted information is identified by parsing the virtual machine code, and the propagation path of the tainted information in the script under test is determined by simulating the execution of the virtual machine operation instructions corresponding to the virtual machine code. Based on the propagation path, security testing is performed on the script under test. By simulating the execution of the virtual machine operation instructions of the script under test, the propagation process of tainted information can be dynamically observed, avoiding malicious behaviors that are obscured or hidden in static analysis. Even if an attacker attempts to bypass the detection system using adversarial methods executed under specific conditions, the execution under these specific conditions can be simulated by dynamically simulating the execution of the virtual machine code of the script under test. Therefore, malicious behaviors triggered by the attacker under specific conditions can also be detected. Thus, this script detection method can reduce the probability of missing dangerous scripts.

[0130] In some embodiments, to further enhance the adversarial nature of script detection, as shown in Figure 2, an "automatic triggering mechanism for uncalled functions" can also be used for script detection. Uncalled functions refer to functions in the script under test that were not called during the aforementioned simulated execution of virtual machine operation instructions. Specifically, for the target function that was not called during the simulated execution of virtual machine operation instructions, the target function can be simulated, and during the simulated execution of the target function, it can be determined whether the target function has reached a preset convergence point. If the target function reaches the preset convergence point, the script under test is determined to be a dangerous script. This implementation can supplement the script detection method shown in Figure 1, further improving the adversarial nature of script detection and thus increasing the probability of dangerous scripts being missed.

[0131] The script detection method provided in this disclosure will be described below with reference to the schematic diagram of the script detection system architecture shown in Figure 2.

[0132] As shown in Figure 2, the "native compiler" in the underlying language support layer compiles the script under test into Virtual Machine Code (VMC), and uses the VMC parser to parse the VMC to obtain taint sources in the VMC; it then determines the taint information introduced by the taint sources from the VMC. The "taint source management module" in the runtime environment simulation layer manages the taint sources. Furthermore, the VMC parser can also be used to parse the VMC into virtual machine operation instructions.

[0133] The "Simulation Execution Module" in the "Runtime Environment Simulation Layer" is used to simulate the execution of virtual machine operation instructions. During this simulation, the stack variable management module manages the local variable table and operand stack during method calls, ensuring the correct allocation, access, and release of variables. The local variable management module manages the lifecycle of local variables in the script under test, including memory allocation, read, and write operations. The utility module provides various auxiliary functions, such as reflection mechanisms, system library calls, and exception handling, supporting the implementation of functions in other modules.

[0134] The taint analysis module is used to track taint information during the simulated execution of virtual machine operation instructions and to call the taint analysis mechanisms shown in the taint analysis layer, such as variable scope pollution mechanism, conditional expression indirect pollution mechanism, uncertainty reasoning mechanism, and I / O indirect propagation heuristic mechanism, to analyze the propagation path of taint information in order to obtain the propagation path of taint information. For specific taint analysis methods, please refer to the relevant content of the foregoing embodiments, which will not be repeated here.

[0135] After obtaining the propagation path of taint information, the aggregation point management module can be used to determine whether the taint information has propagated to the aggregation point. If the result is yes, the script under test can be determined to be a dangerous script. Conversely, if the taint information has not propagated to the preset aggregation point, the script under test can be determined to be a safe script.

[0136] Similarly, the script detection method provided in this disclosure can be deployed on any computing device. Optionally, the script detection method provided in this disclosure can also be deployed on a cloud server as a Software as a Service (SaaS) application. For a cloud server with this SaaS application deployed, the steps in the script detection method described above can be executed in response to a request to call the target service. A specific implementation is shown in Figure 5. This method is applicable to cloud servers and mainly includes:

[0137] 501. In response to a request to invoke the target service, determine the processing resources corresponding to the target service. The target service refers to the service that provides script detection.

[0138] 502. Utilize the processing resources corresponding to the target service to execute the steps in the script detection methods provided in the foregoing embodiments.

[0139] In this embodiment, the target service refers to the service that provides the script detection method. The processing resources corresponding to the target service refer to the processing resources required to execute the above-mentioned script detection method, including but not limited to: processor resources, memory resources, and I / O resources.

[0140] The script detection method provided in this embodiment can be deployed on a cloud server to provide script detection services, i.e., target services, to users. Users can be service providers of the target application, users of the target application, or clients of the target application. Optionally, the cloud server can provide an Application Programming Interface (API) to the user. The service requester (i.e., the user) can call the API to invoke the target service. Accordingly, the request to invoke the target service is implemented as a call event generated by calling the API. The service requester (i.e., the user) can also invoke the target service through Remote Procedure Call (RPC) or Remote Direct Memory Access (RDMA) technologies.

[0141] For cloud servers, in response to a request to call a target service, the processing resources corresponding to the target service can be determined; and steps 101-105 and related specific implementation methods can be executed using the processing resources corresponding to the target service to achieve script risk detection.

[0142] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 101 and 102 can be device A; or the execution subject of step 101 can be device A, and the execution subject of step 102 can be device B; and so on.

[0143] Furthermore, some processes described in the above embodiments and accompanying drawings include multiple operations that appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel.

[0144] Accordingly, this disclosure also provides a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the steps in the script detection methods provided in the foregoing embodiments.

[0145] Computer-readable storage media include volatile or non-volatile or a combination thereof, and may be removable or non-removable. Examples of computer-readable storage media include, but are not limited to, phase-change random access memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital video disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transfer medium.

[0146] This disclosure also includes a computer program product comprising a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps in the script detection methods provided in the foregoing embodiments.

[0147] In this disclosure, the specific implementation form of the computer program product is not limited. In some embodiments, the computer program product may be implemented as an application (APP), a mini-program, a computer-side client, a program module, a plug-in, an installation package, a software development kit (SDK), an image file of an optical disc (such as an ISO file), a plug-in, or software in the form of Software as a Service (SaaS), etc., but is not limited thereto.

[0148] The computer program product should understand that each or a combination of the above-described method flow can be implemented by a computer program or instructions. Furthermore, these computer programs or instructions can be applied to the processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device, enabling the processor of the general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to function as an apparatus for implementing the corresponding functions in the above-described method embodiments.

[0149] Figure 6 is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. As shown in Figure 6, the electronic device includes a memory 60a and a processor 60b. The memory 60a is used to store computer programs and can be configured to store various other data to support operation on a computing platform. Examples of this data include instructions for any application or method operating on the electronic device, data structures, contact data, phonebook data, messages, pictures, videos, etc.

[0150] The processor 60b is coupled to the memory 60a and is used to execute computer programs to perform the steps in the script detection methods provided in the foregoing embodiments. Specific implementation details of each step can be found in the relevant descriptions of the foregoing embodiments, and will not be repeated here.

[0151] In some alternative embodiments, as shown in FIG6, the electronic device may further include optional components such as a communication component 60c, a power supply component 60d, a display component 60e, and an audio component 60f. FIG6 only schematically shows some components and does not mean that the electronic device must include all the components shown in FIG6, nor does it mean that the electronic device can only include the components shown in FIG6.

[0152] Furthermore, the components within the dashed boxes in Figure 6 are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a desktop computer, laptop computer, mobile phone, or IoT device; it can also be a traditional server, cloud server, or server cluster, or other server equipment.

[0153] In embodiments of this disclosure, the memory is used to store computer programs and can be configured to store various other data to support operation on its host device. The processor can execute the computer programs stored in the memory to implement corresponding control logic. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), electrically erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0154] In this embodiment of the disclosure, the processor can be any hardware processing device capable of executing the above-described method logic. Optionally, the processor can be a central processing unit (CPU), a graphics processing unit (GPU), or a microcontroller unit (MCU); it can also be a programmable device such as a field-programmable gate array (FPGA), a programmable array logic (PAL), a general array logic (GAL), or a complex programmable logic device (CPLD); or it can be an advanced RISC machine (ARM) or a system on chip (SoC), etc., but is not limited thereto.

[0155] In this embodiment of the disclosure, the communication component is configured to facilitate wired or wireless communication between its host device and other devices. The device hosting the communication component can access wireless networks based on communication standards, such as 2G or 3G, 4G, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel.

[0156] In embodiments of this disclosure, the display component may include a liquid crystal display (LCD) and a touch panel (TP). If the display component includes a touch panel, the display component may be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors may sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0157] In embodiments of this disclosure, a power supply component is configured to provide power to various components of the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply component resides.

[0158] In embodiments of this disclosure, the audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals. For example, in devices with voice interaction capabilities, voice interaction with a user can be achieved through the audio component.

[0159] It should be noted that the terms "first" and "second" in this article are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0160] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the aforementioned element.

[0161] The above description is merely an embodiment of this disclosure and is not intended to limit the scope of this disclosure. Various modifications and variations can be made to this disclosure by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this disclosure should be included within the scope of the claims of this disclosure.

Claims

1. A script detection method, wherein, include: In response to a script detection request, the script to be tested is compiled into virtual machine code; The virtual machine code is parsed to determine taint information within it. The virtual machine code is parsed into virtual machine operation instructions; Simulate the execution of the virtual machine operation instructions to determine the propagation path of the taint information in the script under test; The security of the script under test is determined based on the propagation path.

2. The method according to claim 1, wherein, The step of parsing the virtual machine code to determine taint information in the virtual machine code includes: Taint source analysis is performed on the virtual machine code to identify taint sources in the virtual machine code; The information introduced by the taint source in the virtual machine code is identified as the taint information.

3. The method according to claim 1 or 2, wherein, The step of simulating the execution of the virtual machine operation instructions to determine the propagation path of the taint information in the script under test further includes: The virtual machine operation instructions are simulated and executed based on the opcodes and operands contained in the virtual machine operation instructions. During the simulated execution of the virtual machine operation instructions, the taint information is tracked to determine the propagation path.

4. The method according to claim 3, wherein, The step of simulating the execution of the virtual machine operation instructions based on the opcodes and operators contained in the virtual machine operation instructions includes: The target method corresponding to the opcode is obtained through reflection. The target method is invoked through the reflection mechanism; The operands are passed to the target method, and the target method is simulated to simulate the execution of the virtual machine operation instructions.

5. The method according to claim 3 or 4, wherein, The step of tracking the taint information during the simulated execution of the virtual machine operation instructions to determine the propagation path includes: During the simulated execution of the virtual machine operation instructions, the taint information is tracked to determine the initial propagation path of the taint information in the script under test and the target element to which the taint information is transferred. The target element is tracked to determine the transfer path of the taint information; The propagation path is determined based on the initial propagation path and the transfer path.

6. The method according to claim 5, wherein, The taint information includes a first variable; tracking the taint information to determine its initial propagation path in the script under test and the target element to which the taint information is transferred includes: Within the scope of the first variable, the taint information is tracked to determine the initial propagation path of the taint information in the script under test and the target element to which the taint information is transferred.

7. The method according to claim 5 or 6, wherein, Determining the propagation path based on the initial propagation path and the transition path includes: Based on the initial propagation path, the transfer path, and the virtual machine operation instructions, the potential propagation paths of the taint information are mined to obtain the potential propagation paths; The initial propagation path, the transfer path, and the potential propagation path are determined as the propagation path.

8. The method according to claim 7, wherein, The step of mining potential propagation paths of the taint information based on the initial propagation path, the transfer path, and the virtual machine operation instructions to obtain potential propagation paths includes: From the virtual machine operation instructions, obtain the first virtual machine operation instruction set corresponding to the initial propagation path and the second virtual machine operation instruction set corresponding to the transfer path; if there are conditional control instructions in the first virtual machine operation instruction set and the second virtual machine operation instruction set, determine the potential propagation path of the taint information according to the conditional control instructions; And / or, If the taint information and / or the target element includes a second variable, the first virtual machine operation instruction set corresponding to the initial propagation path and the second virtual machine operation instruction set corresponding to the transfer path are obtained from the virtual machine operation instructions. If there is a write instruction for the second variable in the first virtual machine operation instruction set and the second virtual machine operation instruction set, the identifier of the file to be written by the write instruction is obtained from the virtual machine operation instructions. If there is a read instruction for the identifier of the file in the virtual machine operation instructions, the flow path from the write instruction to the read instruction is determined as the potential propagation path.

9. The method according to claim 8, wherein, Determining the potential propagation path of the taint information according to the conditional control instruction includes: If the conditional control instruction includes a conditional expression, then if the initial propagation path and / or the transition path does not include all the conditional branches of the conditional expression, the conditional branches not included in the initial propagation path and / or the transition path shall be determined as the potential propagation path. And / or, If the conditional control instruction includes a target selection statement, then all branches of the target selection statement are simulated and run, and the propagation paths of the taint information and the target element in all branches of the target selection statement are tracked to obtain the target propagation path of the taint information and the target element in the target selection statement; the target propagation path is determined as the potential propagation path; wherein, the target selection statement refers to the selection statement that determines the branch to be run based on the value of the dependent variable.

10. The method according to any one of claims 1-9, wherein, The step of compiling the script to be tested into virtual machine code in response to the script detection request includes: In response to a script detection request, the target programming language corresponding to the script to be tested is determined; The native compiler corresponding to the target programming language is invoked to compile the script under test into the virtual machine code.

11. The method according to claim 10, wherein, The step of calling the native compiler corresponding to the target programming language to compile the script under test into the virtual machine code includes: The native compiler is invoked to add framework code supported by the target programming language to the script under test, so as to obtain the source code file corresponding to the script under test; The source code file is compiled using the native compiler to obtain the virtual machine code.

12. The method according to claim 10, wherein, The step of calling the native compiler corresponding to the target programming language to compile the script under test into the virtual machine code includes: During the compilation process of the script under test by the native compiler, the native compiler is invoked to add default implicit code to the script under test; and the script under test with the added implicit code is compiled into the virtual machine code.

13. The method according to claim 10, wherein, The step of parsing the virtual machine code into virtual machine operation instructions includes: A virtual code parser developed using the target programming language parses the virtual machine code into virtual machine operation instructions; The simulated execution of the virtual machine operation instructions includes: A simulator developed using the target programming language is used to simulate the execution of the virtual machine operation instructions.

14. The method according to any one of claims 1-13, wherein, Also includes: For the target function in the script under test that was not simulated to execute the virtual machine operation instructions, the target function was simulated to execute. And determine whether the objective function simulates execution to a preset convergence point; If the judgment result is yes, then the script to be tested is determined to be a dangerous script.

15. The method according to any one of claims 1-14, wherein, The method further includes: After determining that the script under test is a dangerous script, a detection report containing detailed information about the dangerous script and its propagation path is generated; The detection report is sent to a preset receiving terminal, which includes at least one of a script developer terminal and a security administrator terminal.

16. The method according to any one of claims 1-14, wherein, The method further includes: During the simulated execution of the virtual machine operation instructions, log information of the simulated execution is recorded. The log information includes at least one of the following: simulation execution time, simulated execution operation instructions, and changes in taint information status. The log information is stored in a preset log database for subsequent tracing and analysis of the script detection process.

17. A script detection method, applicable to cloud servers, wherein, The method includes: In response to a request to invoke a target service, the processing resources corresponding to the target service are determined; the target service refers to a service that provides script detection. The steps of the method according to any one of claims 1-16 are performed using the processing resources corresponding to the target service.

18. An electronic device, wherein, include: A memory and a processor; wherein the memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 1-17.

19. A computer-readable storage medium storing computer instructions, wherein, When the computer instructions are executed by one or more processors, the one or more processors are caused to perform the steps of the method according to any one of claims 1-17.

20. A computer program product, wherein, Includes a computer program that, when executed by one or more processors, causes the one or more processors to perform the steps of the method according to any one of claims 1-17.

Images