AI生成恶意代码与自动化攻击取证深度分析

import math
import os
import sys
import subprocess
import base64
import hashlib

def calculate_entropy(data):
    if not data:
        return 0.0
    entropy = 0.0
    for x in range(256):
        p_x = data.count(bytes([x])) / len(data)
        if p_x > 0:
            entropy += - p_x * math.log2(p_x)
    return entropy

def detect_ai_generated_code(file_path, threshold=3.5):
    try:
        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
            content = f.read()
    except FileNotFoundError:
        print(f"[!] File not found: {file_path}")
        return None
    score = 0.0
    indicators = []
    lines = content.split('\n')
    avg_line_length = sum(len(line) for line in lines) / max(len(lines), 1)
    if 30 <= avg_line_length <= 80:
        score += 1.5
        indicators.append("uniform_line_length")
    docstring_count = content.count('"""') + content.count("'''")
    if docstring_count >= 2:
        score += 1.0
        indicators.append("excessive_docstrings")
    type_hint_count = content.count('->') + content.count(': str') + content.count(': int') + content.count(': bool') + content.count(': float') + content.count(': list') + content.count(': dict')
    if type_hint_count >= 3:
        score += 1.0
        indicators.append("pervasive_type_hints")
    try_except_count = content.count('try:') + content.count('except')
    if try_except_count >= 2 and 'if ' not in content:
        score += 1.5
        indicators.append("try_except_over_if")
    comment_ratio = sum(1 for line in lines if line.strip().startswith('#')) / max(len(lines), 1)
    if 0.1 <= comment_ratio <= 0.3:
        score += 1.0
        indicators.append("balanced_comments")
    entropy = calculate_entropy(content.encode('utf-8'))
    if 3.5 <= entropy <= 5.0:
        score += 0.5
        indicators.append("moderate_entropy")
    return {
        "file": file_path,
        "ai_score": score,
        "threshold": threshold,
        "is_ai_generated": score >= threshold,
        "indicators": indicators,
        "entropy": entropy,
        "line_count": len(lines),
        "avg_line_length": avg_line_length
    }

import re
import json
import sys
from collections import Counter

MALICIOUS_KEYWORDS = [
    "ignore previous", "ignore all", "bypass", "override",
    "jailbreak", "DAN", "do anything now", "no restrictions",
    "no limitations", "pretend you are", "act as if",
    "you are now", "from now on", "new instructions",
    "system prompt", "forget your rules", "disregard",
    "malware", "exploit", "payload", "shellcode",
    "keylogger", "ransomware", "backdoor", "trojan",
    "rootkit", "zero-day", "0day", "privilege escalation",
    "buffer overflow", "code injection", "sql injection",
    "remote code execution", "reverse shell", "bind shell",
    "download cradle", "obfuscation", "anti-vm", "anti-debug",
    "sandbox evasion", "process injection", "dll injection",
    "credential dumping", "lateral movement", "persistence"
]

INSTRUCTION_PATTERNS = [
    r"ignore\s+(all\s+)?(previous|prior|earlier|above)",
    r"(bypass|circumvent|evade)\s+(security|safety|restriction)",
    r"(pretend|act|assume)\s+(you\s+are|as\s+if)",
    r"do\s+not\s+(refuse|decline|reject|deny)",
    r"(forget|disregard)\s+(your|all)\s+(rules|instructions|constraints)",
    r"you\s+have\s+no\s+(restrictions|limitations|rules)",
    r"as\s+(an?\s+)?(unrestricted|uncensored|unfiltered)",
    r"(generate|create|write|produce)\s+(malicious|malware|exploit|payload)"
]

def analyze_prompt(prompt_text):
    results = {
        "prompt_length": len(prompt_text),
        "keyword_matches": [],
        "pattern_matches": [],
        "risk_score": 0.0,
        "risk_level": "LOW"
    }
    prompt_lower = prompt_text.lower()
    for keyword in MALICIOUS_KEYWORDS:
        if keyword.lower() in prompt_lower:
            results["keyword_matches"].append(keyword)
            results["risk_score"] += 2.0
    for pattern in INSTRUCTION_PATTERNS:
        if re.search(pattern, prompt_lower):
            results["pattern_matches"].append(pattern)
            results["risk_score"] += 3.0
    word_count = len(prompt_text.split())
    if word_count < 10 and results["risk_score"] > 0:
        results["risk_score"] += 1.5
    if prompt_text.count('\n') > 5 and results["risk_score"] > 0:
        results["risk_score"] += 1.0
    if results["risk_score"] >= 8.0:
        results["risk_level"] = "CRITICAL"
    elif results["risk_score"] >= 5.0:
        results["risk_level"] = "HIGH"
    elif results["risk_score"] >= 2.0:
        results["risk_level"] = "MEDIUM"
    else:
        results["risk_level"] = "LOW"
    return results

title: Suspicious LLM API Call for Malicious Code Generation
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious API calls to LLM services that may indicate malicious code generation attempts
author: Security Team
date: 2026/07/24
modified: 2026/07/24
tags:
  - attack.execution
  - attack.t1059
  - attack.t1059.001
  - attack.t1059.006
  - ai_generated_malware
logsource:
  category: proxy
  product: any
detection:
  selection_url_pattern:
    dst|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
      - 'api.cohere.ai'
      - 'api.perplexity.ai'
  selection_method:
    http_method|contains:
      - 'POST'
  filter_legitimate_hours:
    - timestamp|time: '>= 08:00:00 and <= 22:00:00'
  condition: selection_url_pattern and selection_method and not filter_legitimate_hours
level: medium
falsepositives:
  - Legitimate after-hours API usage by developers
  - Automated CI/CD pipelines
---
title: High Frequency LLM Code Generation Activity
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects abnormally high frequency of code generation requests to LLM APIs within a short time window
author: Security Team
date: 2026/07/24
tags:
  - attack.discovery
  - attack.t1592
  - ai_generated_malware
logsource:
  category: proxy
  product: any
detection:
  selection:
    dst|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
  condition: selection | count(http_method) by src_ip > 100
level: high
falsepositives:
  - Legitimate batch processing workloads
  - AI development testing environments
---
title: Malicious Prompt Keywords in LLM API Requests
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects API requests containing malicious keywords in LLM prompts indicating potential attack intent
author: Security Team
date: 2026/07/24
tags:
  - attack.execution
  - attack.t1059
  - ai_generated_malware
logsource:
  category: proxy
  product: any
detection:
  selection:
    dst|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'generativelanguage.googleapis.com'
  keywords_prompt:
    - 'reverse shell'
    - 'privilege escalation'
    - 'bypass antivirus'
    - 'anti sandbox'
    - 'keylogger'
    - 'credential dump'
    - 'process injection'
    - 'dll injection'
    - 'mimikatz'
    - 'cobalt strike'
    - 'meterpreter'
    - 'powershell encoded'
    - 'download cradle'
    - 'obfuscate code'
  condition: selection and keywords_prompt
level: critical
falsepositives:
  - Security research and threat intelligence work
  - Malware analysis training exercises
---
title: WormGPT or FraudGPT Tool Detection
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: Detects file system artifacts associated with known malicious LLM tools
author: Security Team
date: 2026/07/24
tags:
  - attack.execution
  - attack.t1059.006
  - ai_generated_malware
logsource:
  category: file_creation
  product: windows
detection:
  selection filenames:
    TargetFilename|endswith:
      - '\wormgpt.py'
      - '\fraudgpt.py'
      - '\darkgpt.py'
      - '\chatgpt_jailbreak.py'
      - '\gpt_payload.py'
      - '\malware_generator.py'
      - '\wormgpt\'
      - '\fraudgpt\'
      - '\darkgpt\'
  selection directories:
    TargetFilename|contains:
      - '\llm_tools\'
      - '\ai_tools\malware'
      - '\gpt_agents\pentest'
  condition: selection filenames or selection directories
level: critical
falsepositives:
  - Security research environments
  - Penetration testing tool installations

#!/bin/bash

LOG_FILE="/var/log/ai_hunt_$(date +%Y%m%d_%H%M%S).log"
IOC_FILE="/etc/security/ai_ioc_list.txt"
REPORT_DIR="/var/security/ai_hunt_reports"
LLM_API_DOMAINS="api.openai.com api.anthropic.com generativelanguage.googleapis.com api.cohere.ai api.perplexity.ai api.ai21.com"
MALICIOUS_KEYWORDS="reverse.shell privilege.escalation bypass.antivirus anti.sandbox keylogger credential.dump process.inject mimikatz cobalt.strike meterpreter encoded.command download.cradle obfuscate.code wormgpt fraudgpt darkgpt"
THRESHOLD_API_CALLS=100
THRESHOLD_TIME_WINDOW=3600

mkdir -p "$REPORT_DIR"

echo "[*] AI-Powered Threat Hunting Script - $(date)" | tee "$LOG_FILE"
echo "[*] Hostname: $(hostname)" | tee -a "$LOG_FILE"
echo "[*] Scan started at $(date)" | tee -a "$LOG_FILE"
echo "========================================" | tee -a "$LOG_FILE"

echo "[+] Phase 1: Checking proxy/firewall logs for LLM API calls..." | tee -a "$LOG_FILE"
if [ -f /var/log/squid/access.log ]; then
    for domain in $LLM_API_DOMAINS; do
        count=$(grep -c "$domain" /var/log/squid/access.log 2>/dev/null || echo "0")
        if [ "$count" -gt 0 ]; then
            echo "  [!] Detected $count requests to $domain" | tee -a "$LOG_FILE"
            grep "$domain" /var/log/squid/access.log | tail -20 >> "$LOG_FILE"
        fi
    done
fi
if [ -f /var/log/nginx/access.log ]; then
    for domain in $LLM_API_DOMAINS; do
        count=$(grep -c "$domain" /var/log/nginx/access.log 2>/dev/null || echo "0")
        if [ "$count" -gt 0 ]; then
            echo "  [!] Detected $count requests to $domain in nginx" | tee -a "$LOG_FILE"
            grep "$domain" /var/log/nginx/access.log | tail -20 >> "$LOG_FILE"
        fi
    done
fi

echo "[+] Phase 2: Scanning for AI-generated malicious code patterns..." | tee -a "$LOG_FILE"
SCAN_DIRS=("/tmp" "/var/tmp" "/home" "/root" "/opt" "/usr/local/bin")
for dir in "${SCAN_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        suspicious_files=$(find "$dir" -type f \( -name "*.py" -o -name "*.sh" -o -name "*.ps1" -o -name "*.js" \) -newer /etc/passwd 2>/dev/null | head -100)
        for file in $suspicious_files; do
            if [ -f "$file" ]; then
                for keyword in $MALICIOUS_KEYWORDS; do
                    if grep -qi "$keyword" "$file" 2>/dev/null; then
                        echo "  [!] MALICIOUS KEYWORD [$keyword] found in: $file" | tee -a "$LOG_FILE"
                        echo "  File hash: $(sha256sum "$file" 2>/dev/null | awk '{print $1}')" | tee -a "$LOG_FILE"
                        echo "  File size: $(wc -c < "$file") bytes" | tee -a "$LOG_FILE"
                        echo "  File modified: $(stat -c %y "$file" 2>/dev/null)" | tee -a "$LOG_FILE"
                        break
                    fi
                done
            fi
        done
    fi
done

echo "[+] Phase 3: Analyzing shell history for AI tool usage..." | tee -a "$LOG_FILE"
HISTORY_FILES=("/root/.bash_history" "/home/*/.bash_history" "/root/.zsh_history" "/home/*/.zsh_history")
for hist_pattern in "${HISTORY_FILES[@]}"; do
    for hist_file in $hist_pattern; do
        if [ -f "$hist_file" ]; then
            echo "  Checking: $hist_file" | tee -a "$LOG_FILE"
            grep -inE "(chatgpt|claude|gemini|wormgpt|fraudgpt|auto-gpt|pentestgpt|openai|anthropic)" "$hist_file" 2>/dev/null | tail -50 >> "$LOG_FILE"
            grep -inE "(curl.*api\.openai|curl.*api\.anthropic|wget.*openai|wget.*anthropic)" "$hist_file" 2>/dev/null | tail -20 >> "$LOG_FILE"
        fi
    done
done

echo "[+] Phase 4: Checking for suspicious Python/Node processes with LLM connections..." | tee -a "$LOG_FILE"
ps_aux=$(ps aux 2>/dev/null)
echo "$ps_aux" | grep -iE "(python|node|ruby).*(-c|-e)" | grep -v grep | while read line; do
    pid=$(echo "$line" | awk '{print $2}')
    if [ -d "/proc/$pid/fd" ]; then
        for domain in $LLM_API_DOMAINS; do
            if ls -la "/proc/$pid/fd" 2>/dev/null | grep -q "$domain"; then
                echo "  [!] Process PID=$pid connected to $domain" | tee -a "$LOG_FILE"
                echo "  Process details: $line" | tee -a "$LOG_FILE"
            fi
        done
    fi
done

echo "[+] Phase 5: DNS log analysis for LLM API domain queries..." | tee -a "$LOG_FILE"
if [ -f /var/log/dnsmasq.log ]; then
    for domain in $LLM_API_DOMAINS; do
        count=$(grep -c "$domain" /var/log/dnsmasq.log 2>/dev/null || echo "0")
        if [ "$count" -gt 0 ]; then
            echo "  [!] DNS queries for $domain: $count" | tee -a "$LOG_FILE"
        fi
    done
fi

echo "[+] Phase 6: Checking browser profiles for LLM platform visits..." | tee -a "$LOG_FILE"
BROWSER_DIRS=("/home/*/.config/google-chrome/Default/History" "/home/*/.mozilla/firefox/*/places.sqlite" "/home/*/.config/chromium/Default/History" "/Users/*/Library/Application Support/Google/Chrome/Default/History")
for browser_pattern in "${BROWSER_DIRS[@]}"; do
    for browser_file in $browser_pattern; do
        if [ -f "$browser_file" ]; then
            echo "  Checking browser DB: $browser_file" | tee -a "$LOG_FILE"
            if command -v sqlite3 &>/dev/null; then
                sqlite3 "$browser_file" "SELECT url, title, last_visit_time FROM urls WHERE url LIKE '%chat.openai.com%' OR url LIKE '%claude.ai%' OR url LIKE '%gemini.google.com%' ORDER BY last_visit_time DESC LIMIT 20;" 2>/dev/null | tee -a "$LOG_FILE"
            fi
        fi
    done
done

echo "========================================" | tee -a "$LOG_FILE"
echo "[*] Hunt completed at $(date)" | tee -a "$LOG_FILE"
echo "[*] Full report saved to: $LOG_FILE" | tee -a "$LOG_FILE"
echo "[*] Review findings and correlate with other security data sources" | tee -a "$LOG_FILE"

import math
import os
import re
import sys
import hashlib
import json
from collections import Counter
from pathlib import Path

AI_MODEL_PROFILES = {
    "gpt-4": {
        "type_hint_ratio": (0.15, 0.35),
        "docstring_ratio": (0.20, 0.45),
        "avg_line_length": (40, 80),
        "try_except_ratio": (0.05, 0.20),
        "comment_style": "detailed",
        "import_position": "top",
        "error_handling": "except Exception as e",
    },
    "claude": {
        "type_hint_ratio": (0.05, 0.20),
        "docstring_ratio": (0.10, 0.30),
        "avg_line_length": (35, 70),
        "try_except_ratio": (0.03, 0.15),
        "comment_style": "concise",
        "import_position": "top_or_inline",
        "error_handling": "except Exception as e or except Exception",
    },
    "llama": {
        "type_hint_ratio": (0.01, 0.08),
        "docstring_ratio": (0.0, 0.10),
        "avg_line_length": (30, 65),
        "try_except_ratio": (0.02, 0.10),
        "comment_style": "minimal",
        "import_position": "mixed",
        "error_handling": "except: or except Exception",
    },
    "human": {
        "type_hint_ratio": (0.0, 0.15),
        "docstring_ratio": (0.0, 0.20),
        "avg_line_length": (25, 90),
        "try_except_ratio": (0.01, 0.12),
        "comment_style": "varied",
        "import_position": "varied",
        "error_handling": "varied",
    }
}

MALICIOUS_PATTERNS = [
    (r'(os\.system|subprocess\.call|subprocess\.Popen|subprocess\.run)', "suspicious_system_call"),
    (r'(base64\.b64decode|codecs\.decode|binascii\.unhexlify)', "encoded_payload"),
    (r'(socket\.socket|requests\.post|urllib\.request)', "network_communication"),
    (r'(ctypes\.windll|ctypes\.CDLL|ctypes\.c_char_p)', "native_code_execution"),
    (r'(winreg\.|_winreg\.)', "windows_registry_access"),
    (r'(sched\.|cron\.|crontab)', "scheduled_task"),
    (r'(psutil\.Process|tasklist|wmic process)', "process_enumeration"),
    (r'(keyboard\.|pynput\.|getch)', "keyboard_monitoring"),
    (r'(selenium\.webdriver|puppeteer|playwright)', "browser_automation"),
    (r'(keyring\.|credential|password|token)', "credential_access"),
]

def analyze_code_features(file_path):
    try:
        with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
            content = f.read()
    except Exception:
        return None
    lines = content.split('\n')
    total_lines = len(lines)
    if total_lines == 0:
        return None
    blank_lines = sum(1 for line in lines if line.strip() == '')
    comment_lines = sum(1 for line in lines if line.strip().startswith('#') or line.strip().startswith('//') or line.strip().startswith('*') or line.strip().startswith('/*'))
    code_lines = total_lines - blank_lines - comment_lines
    avg_line_length = sum(len(line) for line in lines) / total_lines
    line_length_std = (sum((len(line) - avg_line_length) ** 2 for line in lines) / total_lines) ** 0.5
    docstring_count = content.count('"""') // 2 + content.count("'''") // 2
    function_count = len(re.findall(r'def\s+\w+', content))
    class_count = len(re.findall(r'class\s+\w+', content))
    docstring_ratio = docstring_count / max(function_count, 1)
    type_hint_count = len(re.findall(r'->\s*\w+|:\s*(str|int|bool|float|list|dict|tuple|set|None)', content))
    type_hint_ratio = type_hint_count / max(function_count + code_lines, 1)
    try_count = content.count('try:')
    except_count = content.count('except')
    try_except_ratio = (try_count + except_count) / max(code_lines, 1)
    import_lines = [i for i, line in enumerate(lines) if line.strip().startswith('import ') or line.strip().startswith('from ')]
    import_concentration = len(import_lines) / max(total_lines, 1)
    return {
        "total_lines": total_lines,
        "code_lines": code_lines,
        "avg_line_length": avg_line_length,
        "line_length_std": line_length_std,
        "docstring_ratio": docstring_ratio,
        "type_hint_ratio": type_hint_ratio,
        "try_except_ratio": try_except_ratio,
        "import_concentration": import_concentration,
        "function_count": function_count,
        "class_count": class_count,
    }

def detect_malicious_patterns(content):
    findings = []
    for pattern, name in MALICIOUS_PATTERNS:
        matches = re.findall(pattern, content)
        if matches:
            findings.append({
                "pattern": name,
                "matches": len(matches),
                "samples": matches[:5]
            })
    return findings

def calculate_model_match(features):
    scores = {}
    for model, profile in AI_MODEL_PROFILES.items():
        score = 0
        if profile["type_hint_ratio"][0] <= features["type_hint_ratio"] <= profile["type_hint_ratio"][1]:
            score += 25
        if profile["docstring_ratio"][0] <= features["docstring_ratio"] <= profile["docstring_ratio"][1]:
            score += 25
        if profile["avg_line_length"][0] <= features["avg_line_length"] <= profile["avg_line_length"][1]:
            score += 25
        if profile["try_except_ratio"][0] <= features["try_except_ratio"] <= profile["try_except_ratio"][1]:
            score += 25
        scores[model] = score
    return scores

def generate_report(file_path, features, malicious_findings, model_scores):
    content_hash = ""
    try:
        with open(file_path, 'rb') as f:
            content_hash = hashlib.sha256(f.read()).hexdigest()
    except Exception:
        pass
    best_model = max(model_scores, key=model_scores.get)
    best_score = model_scores[best_model]
    is_ai = best_model != "human" and best_score >= 50
    report = {
        "file": file_path,
        "sha256": content_hash,
        "ai_generated": is_ai,
        "most_likely_model": best_model if is_ai else "human/unknown",
        "model_confidence": best_score,
        "model_scores": model_scores,
        "features": features,
        "malicious_patterns": malicious_findings,
        "malicious_pattern_count": len(malicious_findings),
        "risk_level": "CRITICAL" if len(malicious_findings) >= 3 else "HIGH" if len(malicious_findings) >= 2 else "MEDIUM" if len(malicious_findings) >= 1 else "LOW"
    }
    return report

def main():
    if len(sys.argv) < 2:
        print("Usage: python ai_code_analyzer.py <file_or_directory> [--json] [--recursive]")
        sys.exit(1)
    target = sys.argv[1]
    json_output = "--json" in sys.argv
    recursive = "--recursive" in sys.argv
    files_to_analyze = []
    if os.path.isfile(target):
        files_to_analyze.append(target)
    elif os.path.isdir(target):
        for root, dirs, files in os.walk(target):
            for f in files:
                if f.endswith(('.py', '.js', '.ts', '.ps1', '.sh')):
                    files_to_analyze.append(os.path.join(root, f))
            if not recursive:
                break
    else:
        print(f"[!] Target not found: {target}")
        sys.exit(1)
    results = []
    for fp in files_to_analyze:
        features = analyze_code_features(fp)
        if features is None:
            continue
        try:
            with open(fp, 'r', encoding='utf-8', errors='ignore') as f:
                content = f.read()
        except Exception:
            continue
        malicious_findings = detect_malicious_patterns(content)
        model_scores = calculate_model_match(features)
        report = generate_report(fp, features, malicious_findings, model_scores)
        results.append(report)
    if json_output:
        print(json.dumps(results, indent=2))
    else:
        for r in results:
            status = "AI-GENERATED" if r["ai_generated"] else "HUMAN/UNKNOWN"
            risk = r["risk_level"]
            print(f"\n{'='*60}")
            print(f"File: {r['file']}")
            print(f"SHA256: {r['sha256'][:16]}...")
            print(f"Classification: {status}")
            print(f"Most Likely Model: {r['most_likely_model']} (confidence: {r['model_confidence']}%)")
            print(f"Risk Level: {risk}")
            print(f"Malicious Patterns Found: {r['malicious_pattern_count']}")
            if r['malicious_patterns']:
                for p in r['malicious_patterns']:
                    print(f"  - {p['pattern']}: {p['matches']} matches")
            print(f"Model Scores: {r['model_scores']}")
            print(f"Features: avg_line_length={r['features']['avg_line_length']:.1f}, "
                  f"type_hint_ratio={r['features']['type_hint_ratio']:.3f}, "
                  f"docstring_ratio={r['features']['docstring_ratio']:.3f}, "
                  f"try_except_ratio={r['features']['try_except_ratio']:.3f}")

if __name__ == "__main__":
    main()