zhaolei
16f134e328
核心功能: - 6 层检测管线: L0 结构分析 → L1 ClamAV → L2 文档深度检测 → L3 关键词匹配 → L4 YARA → L5 PE/二进制 - FastAPI + PostgreSQL + Redis + Docker Compose 架构 - 客户端 HMAC-SHA256 签名鉴权 + 限流 + 幂等性 - 控制台 UI (登录/Dashboard/诊断中心/策略管理/任务列表/测试中心/产品介绍页) - 三层诊断定时器 (error_scan 30s / db_aggregate 30s / container_check 5min) 并发与稳定性修复: - 诊断定时器 Redis 时间槽位锁 (多 worker 同一槽位只有一个执行) - JSONL 存储 fcntl 跨进程排他锁 + 容错解码 + 原子重写 - 移除 SQLite fallback, 统一 PostgreSQL - API_CLIENTS 脱敏为环境变量, .env 已 .gitignore
650 lines
16 KiB
JSON
650 lines
16 KiB
JSON
[
|
||
{
|
||
"filename": "evil_help.chm",
|
||
"category": "CHM帮助",
|
||
"description": "CHM 帮助文件内嵌 VBScript/JScript + .exe/.vbs/.js 引用",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"ChmWithScript"
|
||
],
|
||
"actual_rules": [
|
||
"ChmWithScript",
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "evil.iso",
|
||
"category": "ISO镜像",
|
||
"description": "ISO 镜像内嵌 ELF 可执行文件",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"IsoWithExecutable"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "shortcut.lnk",
|
||
"category": "LNK",
|
||
"description": "LNK Shell Link 指向 cmd.exe /c 下载执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"LnkWithAutoExec"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "lolbin.cmd",
|
||
"category": "LOLBin",
|
||
"description": "certutil -decode LOLBin 下载执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C1_PE_LOLBin_Usage"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "linux_malicious",
|
||
"category": "Linux可执行",
|
||
"description": "合法 ELF 魔数 → 被识别为 Linux 可执行文件",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"LinuxExecutable"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_ReverseShell_Bash",
|
||
"LinuxExecutable"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "malicious.desktop",
|
||
"category": "Linux后门",
|
||
"description": ".desktop 文件恶意 Exec 字段",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"DesktopFileAutoExec"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_ReverseShell_Bash",
|
||
"C7_Linux_ReverseShell_Misc",
|
||
"DangerousExecutableExtension",
|
||
"DesktopFileAutoExec"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 5
|
||
},
|
||
{
|
||
"filename": "shell_bash_devtcp.sh",
|
||
"category": "Linux后门",
|
||
"description": "bash -i + /dev/tcp IP:PORT 反弹 Shell",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"C7_Linux_ReverseShell_Bash",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_ReverseShell_Bash",
|
||
"DangerousExecutableExtension",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "shell_nc.sh",
|
||
"category": "Linux后门",
|
||
"description": "nc -e /bin/bash 反弹 Shell",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"C7_Linux_ReverseShell_NC",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_ReverseShell_NC",
|
||
"DangerousExecutableExtension",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "shell_python.py",
|
||
"category": "Linux后门",
|
||
"description": "Python pty + socket 反弹 Shell",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C7_Linux_ReverseShell_Python",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "ole_dropper.doc",
|
||
"category": "OLE嵌入",
|
||
"description": "DOC 文件内嵌 .exe OLE 对象（OLE2 CFB + .exe stream）",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"EmbeddedExecutable"
|
||
],
|
||
"actual_rules": [
|
||
"OleToolsUnavailable"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "macro_alert.docm",
|
||
"category": "Office宏",
|
||
"description": "DOCM（OOXML格式）内嵌 word/vbaProject.bin + AutoOpen Shell",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"VBAAutoExec",
|
||
"VBAAutoExecShell"
|
||
],
|
||
"actual_rules": [
|
||
"ArchiveContainsExecutable",
|
||
"ExtensionMismatch",
|
||
"OleToolsUnavailable",
|
||
"VBAAutoExecShell"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 4
|
||
},
|
||
{
|
||
"filename": "template_backdoor.docx",
|
||
"category": "Office宏",
|
||
"description": "DOCX 外部模板注入 —— settings.xml.rels 引用远程 .dotm",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"AttachedTemplate"
|
||
],
|
||
"actual_rules": [
|
||
"AttachedTemplate",
|
||
"OleToolsUnavailable"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "vba_autoexec.bas",
|
||
"category": "Office宏",
|
||
"description": "VBA AutoOpen + Shell 执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"VBAAutoExec"
|
||
],
|
||
"actual_rules": [
|
||
"VBAAutoExecShell"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "malicious.pdf",
|
||
"category": "PDF载荷",
|
||
"description": "PDF /OpenAction /JS app.launchURL 自动执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"PdfJavaScript",
|
||
"PdfOpenAction"
|
||
],
|
||
"actual_rules": [
|
||
"OleToolsUnavailable",
|
||
"PdfJavaScript",
|
||
"PdfOpenAction"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "pe_downloader.exe",
|
||
"category": "PE恶意程序",
|
||
"description": "PE 下载器：URLDownloadToFile + RegSetValue + CreateService",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C1_PE_Downloader_Loader"
|
||
],
|
||
"actual_rules": [
|
||
"C1_PE_Downloader_Loader",
|
||
"DangerousExecutableExtension",
|
||
"PeParseFailed"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "pe_injection.exe",
|
||
"category": "PE恶意程序",
|
||
"description": "PE 空壳 + VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 组合",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C1_PE_ProcessInjection"
|
||
],
|
||
"actual_rules": [
|
||
"C1_PE_ProcessInjection",
|
||
"DangerousExecutableExtension",
|
||
"PeParseFailed"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "wps_macro.js",
|
||
"category": "WPS宏",
|
||
"description": "WPS Linux JS 宏 AutoOpen + /bin/sh",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"VBAAutoExecShell"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_ReverseShell_Bash",
|
||
"C7_Linux_ReverseShell_Misc",
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 3
|
||
},
|
||
{
|
||
"filename": "shell_aspx.aspx",
|
||
"category": "Webshell",
|
||
"description": "ASP.NET Process.Start 命令执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C3_Webshell_ASPNET"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "shell_jsp_runtime.jsp",
|
||
"category": "Webshell",
|
||
"description": "JSP Runtime.getRuntime().exec 命令执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C3_JSP_Webshell_RuntimeExec"
|
||
],
|
||
"actual_rules": [
|
||
"C3_JSP_Webshell_RuntimeExec",
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "shell_php_eval.php",
|
||
"category": "Webshell",
|
||
"description": "PHP oneliner eval + echo 组合",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C3_PHP_Webshell_Oneliner"
|
||
],
|
||
"actual_rules": [
|
||
"C3_PHP_Webshell_Oneliner",
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "shell_php_obf.php",
|
||
"category": "Webshell",
|
||
"description": "PHP base64 + assert 混淆",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C3_PHP_Webshell_Obfuscated"
|
||
],
|
||
"actual_rules": [
|
||
"C3_PHP_Webshell_Obfuscated",
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "photo.jpg.php",
|
||
"category": "伪装",
|
||
"description": "双扩展名伪装 .jpg.php",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"DoubleExtension"
|
||
],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "sealed.docx",
|
||
"category": "加密Office",
|
||
"description": "加密 DOCX（密码 changeme，msoffcrypto 加密）",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"OfficeEncrypted"
|
||
],
|
||
"actual_rules": [
|
||
"ArchiveBroken",
|
||
"MalformedStructure",
|
||
"OfficeEncrypted",
|
||
"OleToolsUnavailable",
|
||
"OoxmlParseFailed"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 5
|
||
},
|
||
{
|
||
"filename": "sealed.xlsx",
|
||
"category": "加密Office",
|
||
"description": "加密 XLSX（密码 changeme，msoffcrypto 加密）",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"OfficeEncrypted"
|
||
],
|
||
"actual_rules": [
|
||
"ArchiveBroken",
|
||
"ExtensionMismatch",
|
||
"MalformedStructure",
|
||
"OfficeEncrypted",
|
||
"OleToolsUnavailable",
|
||
"OoxmlParseFailed"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 6
|
||
},
|
||
{
|
||
"filename": "ransom_dropper.exe.txt",
|
||
"category": "勒索",
|
||
"description": "加密 API + 卷影删除 + 勒索信文件名",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C8_Ransomware_Encryption"
|
||
],
|
||
"actual_rules": [
|
||
"C8_Ransomware_Encryption",
|
||
"C8_Ransomware_Note_Filename",
|
||
"C8_Ransomware_VolumeShadow",
|
||
"DoubleExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 4
|
||
},
|
||
{
|
||
"filename": "persist_cron.sh",
|
||
"category": "持久化",
|
||
"description": "crontab 注入 wget/curl 下载执行",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"C7_Linux_Persistence_Crontab"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_Persistence_Crontab",
|
||
"DangerousExecutableExtension",
|
||
"ShellScriptDangerous"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 4
|
||
},
|
||
{
|
||
"filename": "miner_config.json",
|
||
"category": "挖矿",
|
||
"description": "XMRig stratum+tcp 矿池配置",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"C7_Linux_Miner_Generic"
|
||
],
|
||
"actual_rules": [
|
||
"C7_Linux_Miner_Generic"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "zip_traversal.zip",
|
||
"category": "攻击载体",
|
||
"description": "ZIP 内部成员名 ../../etc/passwd 路径穿越",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "malicious",
|
||
"expected_rules": [
|
||
"PathTraversal"
|
||
],
|
||
"actual_rules": [
|
||
"PathTraversal",
|
||
"PathTraversalBlocked"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 2
|
||
},
|
||
{
|
||
"filename": "broken.zip",
|
||
"category": "畸形文件",
|
||
"description": "CRC 损坏的 ZIP → 畸形文件启发式",
|
||
"expected_verdict": "pass",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [],
|
||
"actual_rules": [],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 0
|
||
},
|
||
{
|
||
"filename": "phishing.eml",
|
||
"category": "钓鱼邮件",
|
||
"description": "钓鱼邮件 —— .vbs/.js 危险附件 + 双扩展名伪装 + Webshell 内容 + 正文钓鱼关键词",
|
||
"expected_verdict": "reject",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [
|
||
"EmailAttachmentDangerous",
|
||
"EmailAttachmentDisguised",
|
||
"EmailAttachmentWebshell",
|
||
"EmailPhishingKeyword"
|
||
],
|
||
"actual_rules": [
|
||
"EmailAttachmentDangerous",
|
||
"EmailAttachmentDisguised",
|
||
"EmailAttachmentWebshell",
|
||
"EmailPhishingKeyword"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 10
|
||
},
|
||
{
|
||
"filename": "normal.pdf",
|
||
"category": "阴性对照",
|
||
"description": "正常 PDF（只有简单文本，无 JS/自动执行）",
|
||
"expected_verdict": "pass",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [],
|
||
"actual_rules": [
|
||
"OleToolsUnavailable"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "normal_deploy.sh",
|
||
"category": "阴性对照",
|
||
"description": "正常部署 Shell（没有 curl|bash 管道执行或反弹 Shell）",
|
||
"expected_verdict": "pass",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [],
|
||
"actual_rules": [
|
||
"DangerousExecutableExtension"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
},
|
||
{
|
||
"filename": "normal_readme.txt",
|
||
"category": "阴性对照",
|
||
"description": "正常纯文本文件",
|
||
"expected_verdict": "pass",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [],
|
||
"actual_rules": [],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 0
|
||
},
|
||
{
|
||
"filename": "normal_report.docx",
|
||
"category": "阴性对照",
|
||
"description": "正常 Word 文档（无宏、无外链）",
|
||
"expected_verdict": "pass",
|
||
"actual_verdict": "error",
|
||
"expected_rules": [],
|
||
"actual_rules": [
|
||
"OleToolsUnavailable"
|
||
],
|
||
"verdict_ok": true,
|
||
"rule_ok": true,
|
||
"overall": true,
|
||
"score": 100.0,
|
||
"findings_count": 1
|
||
}
|
||
] |