Detecting malicious shell scripts in compute instances of cloud computing platforms
A cloud computing platform provides compute instances of customer accounts. A shell script in a compute instance is evaluated by normalizing the shell script to output a set of tokens that are separated by a predetermined separator. The set of tokens is searched for presence of reference tokens. The counts of the reference tokens in the set of tokens are formed into an occurrence vector, which is evaluated by a machine learning model to determine if the shell script is malicious.
1. A method of detecting malicious shell scripts, the method comprising:
receiving a target shell script in a compute instance of a plurality of compute instances of a cloud computing platform, the compute instance running a distribution of a LINUX operating system;
normalizing the target shell script into a set of tokens, the set of tokens comprising tokens of the target shell script that are separated by a predetermined separator;
searching the set of tokens for presence of reference tokens, the reference tokens comprising predefined tokens that are found in malicious shell scripts that attack compute instances and predefined tokens that are found in non-malicious shell scripts of compute instances;
counting a number of times each of the reference tokens appear in the set of tokens;
generating an occurrence vector of the target shell script, the occurrence vector indicating a count of each of the reference tokens found in the set of tokens; and
evaluating the occurrence vector in the compute instance using a machine learning model to determine if the target shell script is a malicious shell script.
2. The method of claim 1 , wherein normalizing the target shell script includes converting text of the target shell script into lowercase and separating the text using the predetermined separator.
3. The method of claim 2 , wherein the predetermined separator is a space character.
4. The method of claim 1 , wherein the machine learning model is a Support Vector Machine.
5. The method of claim 1 , further comprising:
normalizing goodware samples into respective sets of goodware tokens, each of the goodware samples is a known non-malicious shell script;
for each of the sets of goodware tokens, counting a number of times each of the reference tokens appear in the set of goodware tokens to generate a goodware occurrence vector;
normalizing malware samples into respective sets of malware tokens, each of the malware samples is a known malicious shell script;
for each of the sets of malware tokens, counting a number of times each of the reference tokens appears in the set of malware tokens to generate a malware occurrence vector; and
training the machine learning model to detect malicious and non-malicious shell scripts using a training dataset that comprises goodware occurrence vectors of the goodware samples and malware occurrence vectors of the malware samples.
6. The method of claim 5 , further comprising:
after training the machine learning model, providing the machine learning model to the compute instance over the Internet.
7. A system for detecting malicious shell scripts, the system comprising:
a cloud computing platform comprising at least one processor to:
provide a plurality of compute instances to customer accounts on the cloud computing platform;
receive a target shell script in a compute instance of the plurality of compute instances;
normalize the target shell script to separate text of the target shell script into a set of tokens that are separated by a predetermined separator;
count a number of times each of a plurality of reference tokens appears in the set of tokens, the plurality of reference tokens comprising predefined tokens that are found in malicious shell scripts that attack compute instances and predefined tokens that are found in non-malicious shell scripts of compute instances;
generate an occurrence vector that indicates a count of each of the plurality of reference tokens found in the set of tokens; and
use a Support Vector Machine (SVM) model to evaluate the occurrence vector in the compute instance to determine whether the target shell script is a malicious shell script or a non-malicious shell script; and
a backend system where the SVM model is trained, wherein the SVM model is provided from the backend system to the compute instance over the Internet.
8. The system of claim 7 , wherein the target shell script is normalized by converting text of the target shell script into lowercase characters.
9. The system of claim 8 , wherein the predetermined separator is a space character.
10. The system of claim 7 , wherein the backend system comprises at least one processor to:
normalize goodware samples into respective sets of goodware tokens, each of the goodware samples is a known non-malicious shell script;
for each of the sets of goodware tokens, count a number of times each of the reference tokens appears in the set of goodware tokens to generate a goodware occurrence vector;
normalize malware samples into respective sets of malware tokens, each of the malware samples is a known malicious shell script;
for each of the sets of malware tokens, count a number of times each of the reference tokens appears in the set of malware tokens to generate a malware occurrence vector; and
train the SVM model using a training dataset that comprises goodware occurrence vectors of the goodware samples and malware occurrence vectors of the malware samples.