Reverse Shell Detection Through AST Command-Path Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing reverse shell detection methods suffer from high false positives and negatives due to complexity in detecting deformed or spliced shell commands, especially in languages like Python and Node.js, and traditional static and dynamic detection methods are inadequate.
Innovation Solution
Perform syntax analysis on shell commands using Abstract Syntax Trees (AST) to extract command execution intentions, determine command execution paths, and apply predetermined conditions to accurately identify reverse shell intrusions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static detection is used to detect reverse shell intrusion, then detection complexity is low, but detection accuracy deteriorates with high false positives and negatives
Solution Approach 1:
The patent segments the shell command detection process into multiple analysis dimensions: syntax analysis (parsing command structure), semantic analysis (extracting execution intentions), and path analysis (tracing command execution paths). By dividing the detection task into these modular segments, the system achieves comprehensive analysis without requiring overly complex monolithic detection logic, thus maintaining manageable complexity while improving detection accuracy.
Solution Approach 2:
The patent introduces an intermediary analysis layer that translates shell commands into structured representations (execution intentions and paths). This intermediary representation serves as a bridge between the raw command text and the detection rules, enabling accurate detection without directly comparing against complex threat signatures, thereby reducing false positives while maintaining detection accuracy.
2Measurement precision
If dynamic detection is used to detect reverse shell intrusion, then detection accuracy improves, but detection complexity becomes highly complex
Solution Approach 1:
The patent performs preliminary syntax and semantic analysis on shell commands before executing them, extracting execution intentions and constructing execution paths in advance. This preliminary action allows the system to identify suspicious patterns before the actual command execution occurs, achieving high detection accuracy without requiring complex runtime monitoring and analysis that would characterize traditional dynamic detection approaches.
3Device complexity
If traditional detection methods are used for deformed or spliced shell commands, then detection simplicity is maintained, but detection accuracy deteriorates
Solution Approach 1:
The patent employs dynamic syntax analysis and semantic parsing that can adapt to various command structures including deformed and spliced shell commands. The execution path construction dynamically traces the intended flow regardless of command obfuscation, enabling the system to maintain detection simplicity while accurately identifying malicious patterns in transformed commands that traditional static methods would miss.
Data Source
AI summary
The disclosure provides a detection method and apparatus, an electronic device, and a storage medium. The detection method includes: obtaining a first shell command; performing syntax analysis on the first shell command to obtain a command execution intention for the first shell command; determining a command execution path corresponding to the first shell command based on the command execution intention; and determining whether the first shell command is a reverse shell intrusion command in response to at least one node in the command execution path satisfying a first predetermined condition.