数据与计算发展前沿 ›› 2022, Vol. 4 ›› Issue (5): 77-86.

CSTR: 32002.14.jfdc.CN10-1649/TP.2022.05.009

doi: 10.11871/jfdc.issn.2096-742X.2022.05.009

• 专题:第37次全国计算机安全学术交流会征文 • 上一篇    下一篇

基于特征工程与威胁情报的Webshell检测方法研究

许波1,3,姜政伟2,辛丽玲2,*(),周宇飞1,4   

  1. 1.中国人民公安大学,信息网络安全学院,北京 100038
    2.中国科学院信息工程研究所,北京 100093
    3.成都市公安局,四川 成都 610017
    4.山东省滨海公安局,山东 东营 257013
  • 收稿日期:2022-08-03 出版日期:2022-10-20 发布日期:2022-10-27
  • 通讯作者: 辛丽玲
  • 作者简介:许波,中国人民公安大学,信息与网络安全学院,研究生,警务技术三级主管,主要研究方向为威胁情报处理与网络犯罪打击。
    本文主要承担工作为负责论文初稿撰写、提取Webshell特征与融合多维特征与威胁情报的Webshell检测模型开发。
    Xu Bo is a graduate student in the School of Information and Network Security of the People’s Public Security University of China, a Level 3 supervisor of police technology, whose research interests are threat intelligence processing and cyber-crime fighting.
    In this paper, he is mainly responsible for writing paper draf-ting, extracting Webshell features and developing Webshell de-tection models that fuse multidimensional features with threat intelligence.
    E-mail: 2021212277@stu.ppsuc.edu.cn.|辛丽玲,中国科学院信息工程研究所,工程师,硕士研究生,主要研究方向为网络威胁发现。
    本文主要承担工作为论文修改、审定,参与撰写“3Webshell特征工程”、“4结合威胁情报的Webshell检测方法”。
    Xin Liling, master’s student, is an engi-neer at the Institute of Information Engineering, Chinese Aca-demy of Sciences, whose main research interests are network threat discovery.
    She is mainly responsible for the revision and validation of this paper, and participated in writing “3Webshell Feature Engineering” and “4Webshell Detection Methods Combining Threat Intelligence”.
    E-mail: xinliling@iie.ac.cn
  • 基金资助:
    国家重点研发计划(2018YFB0805005);中国科学院青年创新促进会(2020166)

Research on Webshell Detection Methods Based on Feature Engineering and Threat Intelligence

XU Bo1,3,JIANG Zhengwei2,XIN Liling2,*(),ZHOU Yufei1,4   

  1. 1. People’s Public Security University of China, School of Information Networking Security, Beijing 100038, China
    2. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100093, China
    3. Chengdu Municipal Public Security Bureau, Chengdu, Sichuan 610017, China
    4. Shandong Province, Binhai Public Security Bureau, Dongying, Shandong 257013, China
  • Received:2022-08-03 Online:2022-10-20 Published:2022-10-27
  • Contact: XIN Liling

RichHTML

20

PDF

80

摘要：

【目的】Webshell是一种通过注入、XSS、上传等漏洞渗透手段植入木马产生的可执行脚本,因其构造语言种类不同、利用方法多变、隐秘性强,研究其检测方式能够准确发现渗透入侵网站的恶意攻击行为,在预警、研判、打击非法入侵计算机信息系统等黑客类案件中具有积极意义。【方法】本文提出了一种基于Webshell恶意代码进行行为数据研究并提取特征的创新方法,针对HTTP流量实现基于特征的Webshell检测及网络安全威胁情报建模实验与应用。【结果】通过实际部署应用与实验结果表明,基于提取的特征值识别Webshell的准确度较高,能够有效地发现恶意攻击行为。【结论】基于特征工程的检测方法虽有维护量大的缺点,但对已知特定攻击行为检测精度和效率较高,在预防、打击黑客犯罪的实际应用中是非常有价值的。

关键词: 黑客犯罪, Webshell, HTTP协议, 特征工程, 网络安全威胁

Abstract:

[Objective] Webshell is an executable script generated by implanting a Trojan horse through injection, XSS, upload, and other vulnerability penetration means. Because of the difference in construction language, variable exploitation methods, and stealthy nature, the study of the Webshell detection methods is demanded, which can accurately discover the malicious attack behavior of infiltrating and invading websites, and is of positive significance in early warning, research and judgment, and combating hacker-like cases such as illegal invasion of computer information systems. [Methods] This paper proposes an innovative method to study behavioral data and extract features based on Webshell malicious code, and implements the feature-based Webshell detection and network security threat intelligence modeling experiments and applications for HTTP traffic. [Results] The results from experiments and actual deployment show that the extracted feature values can identify Webshells with high accuracy and can effectively detect malicious attacks. [Conclusions] Although the detection method based on feature engineering has the disadvantage of heavy maintenance, it achieves higher accuracy and efficiency in detecting known specific attacks, which is very valuable in the practical application of preventing and combating hacking crimes.

Key words: hacking crime, Webshell, HTTP protocol, feature engineering, cybersecurity threats