Back to results
US 11,388,182 B2Granted
Method and system for detecting webshell using process information
AssigneeNaver Cloud Corporation
InventorsJune Ahn, BongGoo Kang
Life of this patent
Estimating the term…
Abstract
Disclosed is a webshell detection method that detects a webshell by collecting process information about a process in execution on a server providing a web service and by determining whether the process is executed by a webshell based on the collected process information.
Claims20
A webshell detection method performed by a computer system, comprising:
- collecting process information about a process in execution on a server providing a web service;
- generating a data set about the process based on the collected process information, the generated data set including a process identifier (PID) about the process and additional process information about the process based on the PID;
- determining whether the generated data set includes a pattern;
- and
- determining whether the process is executed by a webshell based on a result of the determining whether the generated data set includes the pattern,
- wherein the pattern is preset based on a combination of at least two pieces of information includable in the additional process information.
3 more elements
A webshell detection method performed by a computer system comprising:
- collecting process information about a process in execution on a server providing a web service, the collecting including generating a data set about the process based on the collected process information;
- determining whether the process is executed by a webshell based on the collected process information, the determining including,
- determining whether the generated data set includes a pattern, and
- determining that the process is executed by the webshell in response to the generated data set being determined to include the pattern;
- adding the generated data set to a waiting queue;
- and
- sequentially determining whether the generated data set includes the pattern with respect to the generated data set added to the waiting queue.
4 more elements
A computer system for detecting a webshell, the computer system comprising:
- at least one processor configured to execute computer-readable instructions,
- wherein the at least one processor is configured to cause the computer system to,
- collect process information about a process in execution on a server providing a web service,
- generate a data set about the process based on the collected process information, the generated data set including a process identifier (PID) about the process and additional process information about the process based on the PID,
- determine whether the generated data set includes a pattern, and
- determine whether the process is executed by a webshell based a result of a determination whether the generated data set includes the pattern,
- wherein the pattern is preset based on a combination of at least two pieces of information includable in the additional process information.
4 more elements
Dependencies are inferred from the claim text.