Method and system for detecting webshell using process information

1. A webshell detection method performed by a computer system, comprising:

collecting process information about a process in execution on a server providing a web service;

generating a data set about the process based on the collected process information, the generated data set including a process identifier (PID) about the process and additional process information about the process based on the PID;

determining whether the generated data set includes a pattern; and

determining whether the process is executed by a webshell based on a result of the determining whether the generated data set includes the pattern,

wherein the pattern is preset based on a combination of at least two pieces of information includable in the additional process information.

2. The webshell detection method of claim 1 , further comprising:

notifying an administrator of the server that the webshell is detected in response to a results of the determining whether the process is executed by a webshell indicating that the process is executed by the webshell.

3. The webshell detection method of claim 1 , wherein

the additional process information comprises at least two of a name of the process, a command line (cmdline) executed in association with the process, system account information that executes the process, a process ID of a parent process (PPID) associated with the process, a name of the parent process, a command line (cmdline) executed in association with the parent process, or system account information that executes the parent process.

4. The webshell detection method of claim 1 , wherein the determining whether the generated data set includes the pattern comprises:

determining whether system account information that executes the process matches system account information that executes the web service or whether a parent process of the process is executed by the web service; and

determining whether a command line executed in association with the process includes a non-generic command line in response to the system account information that executes the process being determined to match the system account information that executes the web service or in response to the parent process of the process being determined to be executed by the web service.

5. The webshell detection method of claim 4 , wherein the determining whether the process is executed by the webshell based on the collected process information comprises determining that the process is executed by the webshell in response to the command line executed in association with the process being determined to include the non-generic command line.

6. The webshell detection method of claim 5 , wherein the non-generic command line comprises at least one of ps, is, cd, cat, or find.

7. The webshell detection method of claim 5 , wherein the command line executed in association with the process is determined to comprise the non-generic command line in response to the command line executed in association with the process being determined to include at least one command line aside from a generic command line.

8. The webshell detection method of claim 4 , wherein the parent process of the process is determined to be executed by the web service in response to the system account information that executes the parent process of the process being determined to match the system account information that executes the web service.

9. The webshell detection method of claim 4 , wherein the parent process of the process is determined to be executed by the web service in response to the system account information that executes the parent process of the process being apache or nobody.

10. A webshell detection method performed by a computer system comprising:

collecting process information about a process in execution on a server providing a web service, the collecting including generating a data set about the process based on the collected process information;

determining whether the process is executed by a webshell based on the collected process information, the determining including,

determining whether the generated data set includes a pattern, and

determining that the process is executed by the webshell in response to the generated data set being determined to include the pattern;

adding the generated data set to a waiting queue; and

sequentially determining whether the generated data set includes the pattern with respect to the generated data set added to the waiting queue.

11. The webshell detection method of claim 10 , wherein

the generated data set includes a process identifier (PID) about the process and additional process information about the process based on the PID,

the additional process information comprises at least two of a name of the process, a command line (cmdline) executed in association with the process, system account information that executes the process, a process ID of a parent process (PPID) associated with the process, a name of the parent process, a command line (cmdline) executed in association with the parent process, or a system account information that executes the parent process, and

the pattern is preset for the additional process information.

12. A non-transitory computer-readable record medium storing instructions that, when executed by at least one processor, cause a computer system to perform the webshell detection method of claim 1 .

13. A computer system for detecting a webshell, the computer system comprising:

at least one processor configured to execute computer-readable instructions,

wherein the at least one processor is configured to cause the computer system to,

collect process information about a process in execution on a server providing a web service,

generate a data set about the process based on the collected process information, the generated data set including a process identifier (PID) about the process and additional process information about the process based on the PID,

determine whether the generated data set includes a pattern, and

determine whether the process is executed by a webshell based a result of a determination whether the generated data set includes the pattern,

wherein the pattern is preset based on a combination of at least two pieces of information includable in the additional process information.

14. The computer system of claim 13 , wherein the at least one processor is further configured to cause the computer system to notify an administrator of the server that the webshell is detected in response to a result of a determination whether the process is executed by a webshell indicating that the process is executed by the webshell.

15. The computer system of claim 13 , wherein the at least one processor is further configured to cause the computer system to,

determine whether system account information that executes the process matches system account information that executes the web service or whether a parent process of the process is executed by the web service,

determine whether a command line executed in association with the process includes a non-generic command line in response to the system account information that executes the process being determined to match the system account information that executes the web service or in response to the parent process of the process being determined to be executed by the web service, and

determine that the process is executed by the webshell in response to the command line executed in association with the process being determined to include the non-generic command line.

16. The computer system of claim 15 , wherein the at least one processor is further configured to cause the computer system to determine determining whether the process is executed by the webshell by determining that the process is executed by the webshell in response to the command line executed in association with the process being determined to include the non-generic command line.

17. The computer system of claim 16 , wherein the at least one processor is further configured to cause the computer system to determine that the command line executed in association with the process comprises the non-generic command line, in response to the command line executed in association with the process being determined to include at least one command line aside from a generic command line.

18. The computer system of claim 15 , wherein the at least one processor is further configured to cause the computer system to determine the parent process of the process to be executed by the web service in response to the system account information that executes the parent process of the process being determined to match the system account information that executes the web service.

19. The computer system of claim 15 , wherein the at least one processor is further configured to cause the computer system to determine the parent process of the process to be executed by the web service in response to the system account information that executes the parent process of the process being apache or nobody.

20. The computer system of claim 13 , wherein the at least one processor is further configured to cause the computer system to,

add the generated data set to a waiting queue, and

sequentially determine whether a subsequently generated data set includes the pattern with respect to the generated data set added to the waiting queue.