论文部分内容阅读
针对及时检测攻击者利用系统漏洞或篡改网页开源代码秘密地在web服务器上嵌入的恶意代码web shell问题,提出了一种基于评分机制的web shell检测系统Evil-hunter.首先,从互联网和各种安全论坛上收集了大量的web shell经常使用的恶意函数样本数据.其次,根据恶意函数在web shell和正常web应用中的不同危险级别和使用频度,利用所提出的评分策略对所收集的样本数据进行评分,并分析统计结果以得出适当的分数阈值.最后,根据所得出的分数阈值,借用简单的检测算法来对web应用中所包含的恶意代码web shell进行识别.实验结果表明,与其他方法相比Evil-hunter具有更高的识别率和准确度.
In order to detect malicious code web shell which is used by the attacker in time to exploit system vulnerabilities or tamper with the open source code of the web page secretly embedded in the web server, a web shell detection system Evil-hunter based on scoring mechanism is proposed. First, The security forum collects a large number of malicious function sample data frequently used by the web shell.Secondly, according to the different risk levels and frequency of malicious functions in the web shell and normal web applications, the proposed scoring strategy is used to analyze the collected samples The data is scored and the statistical results are analyzed to get the appropriate score threshold.Finally, based on the obtained score threshold, a simple detection algorithm is used to identify the malicious code web shell contained in the web application.The experimental results show that Other methods have higher recognition rate and accuracy than Evil-hunter.