SYSTEM AND METHOD FOR DETECTING AND PROTECTING WEBSHELL IN REAL-TIME

摘要

PURPOSE: A system and method for detecting and protecting a webshell in real time is provided to offer the convenience to a manager by offering various information for processing the detection task. CONSTITUTION: A file modification detecting module(102) detects the file generation within a target server or a file modification in real time. A webshell detecting module(104) detects a webshell from the detected file using the webshell signature in a preset regular expression. A webshell processing module(106) restores or deletes a file including the webshell. An attacker tracking module(108) obtains the attacker information including a network address of the attacker using a tracking routine.