Web Shell Detection via Execution Thread Hooks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting web-shell attacks in progress is challenging due to the difficulty in identifying malicious server-side script execution on web servers.
Innovation Solution
Implementing strategically placed hooks on page-executing and sensitive functions to flag and alert potential web-shell attacks by associating data with execution threads and outputting messages to security services, including additional hooks for thread management to ensure accurate detection across various scripting languages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional web server execution is used without hooks, then the system operates with simple architecture and fast execution speed, but it cannot detect web-shell attacks in real-time
Solution Approach 1:
The patent introduces hook functions as intermediary components between the web server execution engine and the security analysis system. These hooks intercept function calls to page-executing functions and sensitive functions, capturing execution context and thread information without modifying the core web server architecture. The hooks act as mediators that enable detection capability while maintaining the original system's operational integrity.
Solution Approach 2:
The detection system is segmented into distinct modular components: page-executing function hooks, sensitive function hooks, thread context management modules, and security service communication modules. Each hook is independently configurable and can be applied selectively to different functions based on risk assessment, allowing the system to scale detection complexity without requiring complete system redesign.
2Reliability
If hooks are added to monitor function execution, then real-time detection capability is improved, but execution speed decreases due to additional overhead
Solution Approach 1:
The system applies hooks selectively rather than universally - prioritizing monitoring of sensitive functions that are most commonly exploited by web shells while using fewer or no hooks on less critical page-executing functions. This partial monitoring approach captures sufficient attack indicators while minimizing the performance overhead associated with comprehensive hooking of all functions.
Solution Approach 2:
The hook implementation uses self-service mechanisms including thread-local storage for context management and automatic thread pool integration that eliminates the need for external synchronization overhead. The hooks leverage existing thread management infrastructure to pass context information efficiently without adding blocking operations or complex inter-thread communication that would slow down execution.
3Measurement precision
If thread context association is implemented to track execution across threads, then detection accuracy across multi-threaded environments is improved, but system complexity increases
Solution Approach 1:
The system introduces thread context objects as intermediary data structures that encapsulate execution state information. These context objects are passed through the thread pool mechanism and wrapped callback functions, serving as mediators that carry thread identification and execution state information without requiring direct manipulation of thread internals or complex thread synchronization primitives.
Solution Approach 2:
When execution context needs to be transferred to thread pool workers or wrapped callbacks, the system creates lightweight copies of the essential thread context information rather than maintaining complex shared state. This copying approach ensures thread-safe operation and simplifies context management while preserving the necessary information for attack detection across thread boundaries.
4Reliability
If comprehensive hooking of all functions is implemented, then detection coverage is maximized, but system performance and maintainability deteriorate
Solution Approach 1:
The system implements risk-based selective hooking where hooks are prioritized on sensitive functions that present higher security risks based on historical exploit patterns and vulnerability assessments. This allows the system to achieve effective detection coverage by monitoring the most critical attack vectors while leaving lower-risk functions unmonitored, thereby reducing overall system complexity and improving maintainability.
Solution Approach 2:
The hook configuration system allows dynamic adjustment of monitoring parameters including which functions are hooked, the depth of context capture, and the aggressiveness of security analysis. These configurable parameters enable the system to adapt to different operational requirements and risk profiles, simplifying maintenance by allowing administrators to tune detection sensitivity and scope without code changes.
Data Source
AI summary
A method includes placing a first hook on a page-executing function configured to execute a web page on a web server, and placing a second hook on at least one sensitive function. The first hook is configured to ascertain whether the page-executing function is called to execute a server-side script, and in response to the page-executing function being called to execute a server-side script, associate, with a current execution thread, data associated with the calling of the page-executing function and indicating that the page-executing function is called to execute the server-side script. The second hook is configured to ascertain whether the sensitive function is called from an execution thread associated with the data, and in response to the sensitive function being called from an execution thread associated with the data, output a message including the data. Other embodiments are also described.