一种基于高速网络的WebShell综合检测溯源技术研究与实现

Research and Implementation on WebShell Comprehensive Detection and Traceability Technology Based on High-speed Network

WebShell是常见的Web脚本入侵攻击工具。攻击者将WebShell植入网站服务器后可对网站服务器进行控制,获取服务器操作权限。WebShell通常嵌套在正常网页脚本中,具有极强的隐蔽性,对网站自身及访问者带来极大危害。针对这些问题,文章提出一种基于DPDK的高速网络流量分析检测技术,在高速网络环境中对网络流量进行数据包捕获和解析,并通过特征码匹配的方式实现对WebShell的高效检测,同时对WebShell文件和攻击者进行溯源分析。

WebShell is a common Web script intrusion attack tool.By implanting WebShell into the Website server,the Website server can be controlled and the server operating program permissions can be obtained.WebShell is usually nested in normal Webpage scripts,which has strong concealment and brings great harm to the Website itself and visitors.In response to the above problems,this paper proposes a high-speed network traffic analysis and detection technology based on DPDK,which captures and analyzes network traffic in a highspeed network environment,and realizes efficient detection of WebShell in traffic data packets through feature code matching.At the same time,the WebShell file and the attacker are traced and analyzed.