| 摘要 |
<p>A technology for improving a web shell program detection capacity by selectively inspecting the changed file is provided to inspect necessary web program file through a cache file composed with a hash code for improving web shell detection performance based on hash validation. A hash value(14) toward an absolute path of the web program file is generated in a process inspecting the initial 1 time total web program file(10). The final change time of the web program file is obtained. The obtained time is stored in a cache file. If the hash value does not exist in the cache file, the hash value is added to the cache file with the final change time of the web program file. In case that the hash value includes final change time, the new final change time is stored in the cache file.</p> |
