Built an online machine learning Webshell to detect restful APIs

Address

Http://118.190.147.89:5000/

Description

Simple machine learning-based detection Webshell:
Currently only supports PHP detection

#使用方法:
 1. Upload detection file
  interface address:/put
  Request by: POST
  Receive parameters: File
  For example:
    The current upload mode supports 2 format [php,zip]
   curl http:/ /127.0.0.1:5000/put-f [email protected]
   curl Http://127.0.0.1:5000/put-F [email  Protected]
    the task ID (taskid)

 2 is returned after the command is executed. Get test results
   interface Address:/result/< Taskid>
   Request: GET
   For example:
   http://127.0.0.1:5000/result/ 9b4c561a111b25a95666bcd5f062ce00

   return data structure:
   type: JSON
   field:
   code (int), MSG (dict):
    When code is 1 o'clock, the task is in progress, MSG returns the appropriate information
    When code is 2 o'clock, the task has not started, MSG returns a message, if the regular time does not start possible queue exception, you can contact the administrator to resolve
    when code is 0 o'clock, the task execution completes, MSG returns the corresponding data content
     when code is 0 concrete structure is as follows:

   {    code:0,    msg: {     status:0,     file_hash:string,     file_name:string,     result: {      filename: Boolean     }}}   

# Update Log
June 12, 2018 Deployment Add

# Contact Information:
Sevck#jdsec.com

# Miscellaneous

Simply say the architecture, use FLASK,MONGODB,RABBITMQ

Flask mainly to do the Web:

/index, more simple instructions for use

/put, upload task, return TaskID

/result/<taskid>, task query results, based on dynamic routing, taskid,32 bit, query task results

MongoDB is primarily used to access task results:

Put task will be the task ID, file attributes, etc. to upload, task status into MongoDB, result query the results of this taskid task

Check is primarily the core machine learning engine:

Detection file is not Webshell

RABBITMQ, Message Queuing, to a push into the queue

In order to ensure the order of the task and the late update iteration, the use of Message Queuing for transmission, in the middle of the persistence, to prevent hanging off or other unexpected situation.

Built an online machine learning Webshell to detect restful APIs