Patent ID: 11863587
Assignee: HUAWEI TECHNOLOGIES CO., LTD.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 9:
10. A security device, comprising:
a memory;
a processor;
a network interface; and
a bus;
wherein the memory, the processor, and the network interface are connected to each other by using the bus;
wherein the network interface is configured to obtain first web traffic of a protected host, wherein the first web traffic is traffic generated when a plurality of web page files provided by the protected host are visited during a first period; and
wherein the processor executes program code stored in the memory to perform operations comprising:
generating a web page visit record of the protected host based on the first web traffic, wherein the web page visit record includes a uniform resource locator (URL) of each of the plurality of web page files, an IP address of each of a plurality of visitors visiting each of the plurality of web page files, and a total quantity of visits from the plurality of visitors to each of the plurality of web page files, wherein the generating further comprises performing at least one normalization processing operation on the URL;
determining a suspicious web page file from the plurality of web page files provided by the protected host, wherein the suspicious web page file is determined based on the total quantity of visits to the suspicious web page file from the plurality of visitors and a ratio between a quantity of different IP addresses of the plurality of visitors visiting the suspicious web page file and the total quantity of visits to the suspicious web page file from the plurality of visitors, wherein the total quantity of visits to the suspicious web page file from the plurality of visitors is less than a first threshold, and the ratio is less than a second threshold;
determining whether the suspicious web page file contains a webshell signature in a webshell signature database; and
detecting, based on a webshell signature determining result, whether a webshell exists in the suspicious web page file.