Script detection method and device

Abstract

The invention provides a script detection method and device. The script detection method and device are applied to a security detection engine adopting a reasoning framework. The safety detection engine is pre-loaded with an inference strategy library; the reasoning strategy library comprises a plurality of reasoning strategies used for reasoning confrontation means adopted by confrontation statements used for confrontation detection and contained in the script to be detected. The method comprises the steps of determining whether a target statement to be executed is a suspected adversarial statement or not in a process of running each statement contained in a script to be detected in a simulated running environment; and if the target statement is the suspected adversarial statement, executing an inference strategy in an inference strategy library, and inferring an adversarial means adopted by the target statement to obtain adversarial information used for describing the adversarial means adopted by the target statement. And correcting a target statement based on the confrontation information, executing the corrected target statement, and further determining whether the target statement is a confrontation statement or not based on an execution result.

Description

technical field [0001] The embodiments of the present specification relate to the field of computer technology, and more particularly, the embodiments of the present specification relate to a script detection method and apparatus. Background technique [0002] This section is intended to provide a background or context for the embodiments of the present specification that are recited in the claims. The descriptions herein are not admitted to be prior art by inclusion in this section. [0003] In the field of network data security, scripts with malicious behavior usually use various confrontation methods to resist the detection of the security system; in related technologies, the script to be detected is usually detected dynamically by simulating running in a sandbox. Therefore, some scripts have added countermeasures against dynamic detection, such as branch countermeasures that introduce branch statements, version countermeasures that use multiple language types or version...

AI Technical Summary

Problems solved by technology

Therefore, some scripts have added countermeasures against dynamic detection, such as branch countermeasures that introduce branch statements, version countermeasures that use multiple language types or versions to write scripts, etc., so that conventional dynamic detection methods cannot correctly identify the countermeasures introduced above. The behavior of the script, thus resisting dynamic detection

Images