feat: 旧样本 L7 归类 + 中文规则标签
- rules/rule_labels.yaml: 64 条 rule_name → 中文标签映射 - console.py: 加载 rule_labels + layer_definitions 传给 template - test_center.html: 期望规则 / 实际规则 全显示中文名（hover 保留英文原名） - scripts/regen_v2.py: 全量扫描自动打 L7 标签 + case_id - tests/samples/index.json: 168 条全有 case_id，层分布 L0=27 L1=25 L3=25 L4=15 L5=21 NEG=20 L7=35 前端效果: NC 反弹 Shell / UPX 加壳 / 压缩包路径穿越 / RWX 可写可执行节...
This commit is contained in:
@@ -885,6 +885,25 @@ async def test_page(request: Request, current=Depends(require_login)):
|
||||
|
||||
samples_dir = Path(__file__).resolve().parent.parent / "tests" / "samples"
|
||||
index_path = samples_dir / "index.json"
|
||||
labels_path = Path(__file__).resolve().parent.parent / "rules" / "rule_labels.yaml"
|
||||
|
||||
# 加载规则中文标签
|
||||
rule_labels: dict[str, str] = {}
|
||||
layer_definitions: dict[str, str] = {}
|
||||
try:
|
||||
import yaml as _yaml
|
||||
if labels_path.exists():
|
||||
_lbl_raw = _yaml.safe_load(labels_path.read_text(encoding="utf-8")) or {}
|
||||
# 映射 engine_rule_name → 中文标签
|
||||
for k, v in _lbl_raw.items():
|
||||
if isinstance(v, dict) and "label" in v:
|
||||
rule_labels[k] = v["label"]
|
||||
# 层定义
|
||||
if index_path.exists():
|
||||
_idx = json.loads(index_path.read_text(encoding="utf-8"))
|
||||
layer_definitions = _idx.get("layer_definition", {})
|
||||
except Exception: # noqa: BLE001
|
||||
pass
|
||||
|
||||
rescan = request.query_params.get("rescan") == "1"
|
||||
samples_list: list[Path] = []
|
||||
@@ -1146,6 +1165,8 @@ async def test_page(request: Request, current=Depends(require_login)):
|
||||
"policy_version": policy_version,
|
||||
"last_run_at": last_run_at,
|
||||
"rescan": rescan,
|
||||
"rule_labels": rule_labels,
|
||||
"layer_definitions": layer_definitions,
|
||||
},
|
||||
)
|
||||
|
||||
|
||||
@@ -139,7 +139,7 @@
|
||||
{% if r.expected_rules %}
|
||||
<div style="margin-top:4px;">
|
||||
{% for rule in r.expected_rules %}
|
||||
<span class="chip chip-gray" style="font-family:monospace;font-size:10px;">{{ rule }}</span>
|
||||
<span class="chip chip-gray" style="font-size:10px;" title="{{ rule }}">{{ rule_labels.get(rule, rule) }}</span>
|
||||
{% endfor %}
|
||||
</div>
|
||||
{% endif %}
|
||||
@@ -152,7 +152,7 @@
|
||||
{% if r.actual_rules %}
|
||||
<div style="margin-top:4px;">
|
||||
{% for rule in r.actual_rules %}
|
||||
<span class="chip chip-{% if rule in r.expected_rules %}ok{% else %}info{% endif %}" style="font-family:monospace;font-size:10px;">{{ rule }}</span>
|
||||
<span class="chip chip-{% if rule in r.expected_rules %}ok{% else %}info{% endif %}" style="font-size:10px;" title="{{ rule }}">{{ rule_labels.get(rule, rule) }}</span>
|
||||
{% endfor %}
|
||||
</div>
|
||||
{% elif r.actual_verdict in ('pass', 'clean') %}
|
||||
|
||||
280
rules/rule_labels.yaml
Normal file
280
rules/rule_labels.yaml
Normal file
@@ -0,0 +1,280 @@
|
||||
# MeshSafe 规则名中文标签映射
|
||||
# 前端显示时用中文名代替引擎内部的英文 rule_name
|
||||
# 层级分组对应 CSV 里的 L0-L5 + NEG + L7
|
||||
|
||||
# ===== L0 结构分析 =====
|
||||
ArchiveBroken:
|
||||
label: "压缩包损坏"
|
||||
desc: "ZIP/7z 结构异常，目录项或文件头损坏"
|
||||
|
||||
ArchiveContainsExecutable:
|
||||
label: "压缩包内含可执行文件"
|
||||
desc: "归档内包含 .exe/.dll/.sys/.scr 等 PE 文件"
|
||||
|
||||
ExtensionMismatch:
|
||||
label: "后缀伪装"
|
||||
desc: "文件声明扩展名与真实幻数不符（如 jpg 后缀实际 MZ 头）"
|
||||
|
||||
DoubleExtension:
|
||||
label: "双扩展名伪装"
|
||||
desc: "文件名含两个扩展名，隐藏真实后缀（如 report.pdf.exe）"
|
||||
|
||||
DangerousExecutableExtension:
|
||||
label: "危险可执行扩展名"
|
||||
desc: "文件后缀属于可执行/脚本类型（exe/ps1/bat/cmd/js/vbs 等）"
|
||||
|
||||
ShellScriptDangerous:
|
||||
label: "危险脚本扩展名"
|
||||
desc: "shell/bash/powershell 等脚本类扩展名"
|
||||
|
||||
PathTraversal:
|
||||
label: "压缩包路径穿越"
|
||||
desc: "ZIP 内文件名包含 ../ 或绝对路径，可能覆盖系统文件"
|
||||
|
||||
PathTraversalBlocked:
|
||||
label: "路径穿越已拦截"
|
||||
desc: "扫描器已阻止路径穿越文件落地"
|
||||
|
||||
ArchiveBombSuspect:
|
||||
label: "ZIP 炸弹"
|
||||
desc: "压缩比异常高（如 42.zip），解压膨胀可能耗尽磁盘/内存"
|
||||
|
||||
EncryptedArchive:
|
||||
label: "加密压缩包"
|
||||
desc: "ZIP 设置了打开密码，无法扫描内部内容"
|
||||
|
||||
MalformedStructure:
|
||||
label: "文件结构畸形"
|
||||
desc: "文件能识别但内部结构不符合该格式规范"
|
||||
|
||||
ZeroByteFile:
|
||||
label: "零字节文件"
|
||||
desc: "空文件（0 字节）"
|
||||
|
||||
# ===== L1 ClamAV =====
|
||||
"ClamAV:EICAR":
|
||||
label: "ClamAV EICAR 测试病毒"
|
||||
desc: "命中 ClamAV EICAR-STANDARD-ANTIVIRUS-TEST-FILE 签名"
|
||||
|
||||
Eicar-Test-Signature:
|
||||
label: "EICAR 测试签名"
|
||||
desc: "ClamAV 识别到 EICAR 标准测试串（行业无害测试）"
|
||||
|
||||
# ===== L2 文档深度 =====
|
||||
OfficeEncrypted:
|
||||
label: "Office 加密文档"
|
||||
desc: "DOCX/XLSX/PPTX 设置了打开密码"
|
||||
|
||||
OleToolsUnavailable:
|
||||
label: "OLE 工具不可用"
|
||||
desc: "olefile 未安装，无法扫描 OLE 结构"
|
||||
|
||||
OoxmlParseFailed:
|
||||
label: "OOXML 解析失败"
|
||||
desc: "DOCX/XLSX/PPTX ZIP 内部 XML 损坏"
|
||||
|
||||
AttachedTemplate:
|
||||
label: "模板注入风险"
|
||||
desc: "Word 文档关联了外部模板（可能触发模板后门）"
|
||||
|
||||
VBAAutoExecShell:
|
||||
label: "VBA 宏自动执行 Shell"
|
||||
desc: "检测到 AutoOpen/Workbook_Open 等自动执行入口 + Shell/CreateObject 等危险调用"
|
||||
|
||||
PdfJavaScript:
|
||||
label: "PDF 内含 JavaScript"
|
||||
desc: "PDF 文档嵌入可执行 JavaScript"
|
||||
|
||||
PdfOpenAction:
|
||||
label: "PDF OpenAction 跳转"
|
||||
desc: "PDF 启动时有自动跳转/打开外部链接动作"
|
||||
|
||||
PdfParseFailed:
|
||||
label: "PDF 解析失败"
|
||||
desc: "PDF 结构异常或为占位文件，无法正常解析"
|
||||
|
||||
ChmWithScript:
|
||||
label: "CHM 内含脚本"
|
||||
desc: "CHM 帮助文档包含 ActiveScript/JScript"
|
||||
|
||||
DesktopFileAutoExec:
|
||||
label: "Linux .desktop 自动执行"
|
||||
desc: ".desktop 文件设置了自动执行属性"
|
||||
|
||||
# ===== L3 关键词匹配 =====
|
||||
ReverseShellNetcat:
|
||||
label: "NC 反弹 Shell"
|
||||
desc: "包含 nc/ncat/netcat /bin/bash -i >& /dev/tcp/ 等反弹 shell 特征"
|
||||
|
||||
ReverseShellPowershell:
|
||||
label: "PowerShell EncodedCommand"
|
||||
desc: "包含 powershell -enc / -w hidden 等混淆执行"
|
||||
|
||||
CredentialStealer:
|
||||
label: "凭据窃取工具"
|
||||
desc: "包含 mimikatz/sekurlsa/gsecdump/DCSync/Rubeus 等"
|
||||
|
||||
CredentialExport:
|
||||
label: "凭据导出命令"
|
||||
desc: "包含 reg save HKLM\\SAM/SYSTEM/secretsdump 等"
|
||||
|
||||
RemoteDownloadPowerShell:
|
||||
label: "PowerShell 远程下载"
|
||||
desc: "Invoke-WebRequest/Invoke-RestMethod/DownloadString/BitsAdmin 等"
|
||||
|
||||
RemoteDownloadUnix:
|
||||
label: "Unix 远程下载"
|
||||
desc: "wget/curl/certutil -urlcache -split 等"
|
||||
|
||||
RemoteSessionHijack:
|
||||
label: "远程会话劫持"
|
||||
desc: "tscon/rdpclip/shadow/CreateRemoteThread 等"
|
||||
|
||||
CommandExecutionObfuscated:
|
||||
label: "命令执行混淆"
|
||||
desc: "certutil -decode/mshta/regsvr32 /s 等混淆执行"
|
||||
|
||||
WMILdapAttack:
|
||||
label: "WMI/LDAP 攻击"
|
||||
desc: "wmic path/wmic process call create/ldapsearch 等"
|
||||
|
||||
ClassifiedLevelMarkers:
|
||||
label: "涉密密级标记"
|
||||
desc: "包含绝密/机密/秘密/内部文件/禁止外传等密级标识"
|
||||
|
||||
InternalDocumentPatterns:
|
||||
label: "国家机密标识"
|
||||
desc: "包含国家机密|涉密|密级：等关键词"
|
||||
|
||||
# ===== L4 YARA =====
|
||||
# 留空 → YARA 规则文件自己的 rule name 就是中文或 meta 里有描述
|
||||
|
||||
# ===== L5 PE 二进制 =====
|
||||
UPXPackerDetected:
|
||||
label: "UPX 加壳"
|
||||
desc: "PE 节名包含 UPX0/UPX1/UPX!，检测到 UPX 加壳"
|
||||
|
||||
RWXSectionDetected:
|
||||
label: "RWX 可写可执行节"
|
||||
desc: "PE 节同时设置了 MEM_EXECUTE + MEM_WRITE，典型绕过 DEP 手法"
|
||||
|
||||
HighEntropySection:
|
||||
label: "节区熵值异常"
|
||||
desc: "PE 节熵 ≥ 7.2，可能经过加密或加壳"
|
||||
|
||||
SuspiciousImports:
|
||||
label: "可疑导入表"
|
||||
desc: "PE 导入表包含 VirtualAllocEx/WriteProcessMemory/CreateRemoteThread 等高危注入 API"
|
||||
|
||||
UnsignedExecutable:
|
||||
label: "未签名可执行文件"
|
||||
desc: "PE 未携带 Authenticode 数字签名"
|
||||
|
||||
SuspiciousTimestamp:
|
||||
label: "编译时间戳异常"
|
||||
desc: "PE 编译时间戳为 0 或指向未来时间，可能被伪造"
|
||||
|
||||
PEArchInfo:
|
||||
label: "PE 架构信息"
|
||||
desc: "PE 架构识别（x86/x64/ARM 等），辅助判断"
|
||||
|
||||
DebugInformationPresent:
|
||||
label: "含调试信息"
|
||||
desc: "PE 包含 PDB 调试路径或 .debug 节"
|
||||
|
||||
PeParseFailed:
|
||||
label: "PE 结构解析失败"
|
||||
desc: "pefile 无法解析 PE，可能是畸形文件"
|
||||
|
||||
LinuxExecutable:
|
||||
label: "Linux ELF 可执行"
|
||||
desc: "ELF 格式 Linux 可执行文件"
|
||||
|
||||
# ===== C1/C3/C7/C8 自动命名规则 =====
|
||||
"C1_PE_Downloader_Loader":
|
||||
label: "YARA: PE 下载木马"
|
||||
desc: "YARA C1_PE_Downloader_Loader 规则命中"
|
||||
|
||||
"C1_PE_ProcessInjection":
|
||||
label: "YARA: PE 进程注入"
|
||||
desc: "YARA C1_PE_ProcessInjection 规则命中"
|
||||
|
||||
"C3_PHP_Webshell_Oneliner":
|
||||
label: "YARA: PHP 一句话木马"
|
||||
desc: "YARA C3_PHP_Webshell_Oneliner 规则命中"
|
||||
|
||||
"C3_PHP_Webshell_Obfuscated":
|
||||
label: "YARA: PHP 混淆木马"
|
||||
desc: "YARA C3_PHP_Webshell_Obfuscated 规则命中"
|
||||
|
||||
"C3_JSP_Webshell_RuntimeExec":
|
||||
label: "YARA: JSP Runtime exec 木马"
|
||||
desc: "YARA C3_JSP_Webshell_RuntimeExec 规则命中"
|
||||
|
||||
"C7_Linux_ReverseShell_Bash":
|
||||
label: "YARA: Bash 反弹 Shell"
|
||||
desc: "YARA C7_Linux_ReverseShell_Bash 规则命中"
|
||||
|
||||
"C7_Linux_ReverseShell_NC":
|
||||
label: "YARA: NC 反弹 Shell"
|
||||
desc: "YARA C7_Linux_ReverseShell_NC 规则命中"
|
||||
|
||||
"C7_Linux_ReverseShell_Misc":
|
||||
label: "YARA: Linux 反弹 Shell（其他）"
|
||||
desc: "YARA C7_Linux_ReverseShell_Misc 规则命中"
|
||||
|
||||
"C7_Linux_Persistence_Crontab":
|
||||
label: "YARA: Crontab 持久化"
|
||||
desc: "YARA C7_Linux_Persistence_Crontab 规则命中"
|
||||
|
||||
"C7_Linux_Miner_Generic":
|
||||
label: "YARA: 挖矿程序"
|
||||
desc: "YARA C7_Linux_Miner_Generic 规则命中"
|
||||
|
||||
"C8_Ransomware_Encryption":
|
||||
label: "YARA: 勒索加密特征"
|
||||
desc: "YARA C8_Ransomware_Encryption 规则命中"
|
||||
|
||||
"C8_Ransomware_Note_Filename":
|
||||
label: "YARA: 勒索赎金文件名"
|
||||
desc: "YARA C8_Ransomware_Note_Filename 规则命中"
|
||||
|
||||
"C8_Ransomware_VolumeShadow":
|
||||
label: "YARA: VSS 卷影副本删除"
|
||||
desc: "YARA C8_Ransomware_VolumeShadow 规则命中"
|
||||
|
||||
# ===== 邮件 =====
|
||||
EmailAttachmentDangerous:
|
||||
label: "邮件附件危险"
|
||||
desc: "EML 包含 .exe/.dll/.ps1 等危险附件"
|
||||
|
||||
EmailAttachmentDisguised:
|
||||
label: "邮件附件伪装"
|
||||
desc: "EML 附件扩展名与真实类型不符"
|
||||
|
||||
EmailAttachmentWebshell:
|
||||
label: "邮件附件 Webshell"
|
||||
desc: "EML 附件为 PHP/ASP/JSP 一句话木马"
|
||||
|
||||
EmailPhishingKeyword:
|
||||
label: "钓鱼邮件关键词"
|
||||
desc: "EML 正文包含钓鱼诈骗关键词"
|
||||
|
||||
# ===== 其他 =====
|
||||
SuspiciousScript:
|
||||
label: "可疑脚本"
|
||||
desc: "脚本内容触发通用恶意特征"
|
||||
|
||||
"Txt.Malware.Sustes-6779550-1":
|
||||
label: "ClamAV: Sustes 木马变体"
|
||||
desc: "ClamAV 识别到 Sustes 木马家族签名"
|
||||
|
||||
# ===== verdict → 中文 =====
|
||||
# （前端直接写死在 template 里，这里留文档）
|
||||
verdict_labels:
|
||||
clean: "干净（放行）"
|
||||
suspicious: "可疑（人工审核）"
|
||||
reject: "拦截（零容忍）"
|
||||
malicious: "恶意（零容忍）"
|
||||
pending: "待测"
|
||||
unknown: "未知"
|
||||
File diff suppressed because it is too large
Load Diff
Reference in New Issue
Block a user