{"id":28398469,"url":"https://github.com/aapanel/btshieldml","last_synced_at":"2025-06-28T14:31:11.292Z","repository":{"id":289451162,"uuid":"966040455","full_name":"aaPanel/btShieldML","owner":"aaPanel","description":"bt-ShieldML，基于机器学习的堡塔木马查杀引擎，针对Web服务器环境中的恶意代码文件进行检测","archived":false,"fork":false,"pushed_at":"2025-05-27T07:30:11.000Z","size":10096,"stargazers_count":26,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-06-21T13:47:46.006Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"agpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aaPanel.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-04-14T10:04:02.000Z","updated_at":"2025-06-20T15:19:57.000Z","dependencies_parsed_at":null,"dependency_job_id":"477fe689-0f5e-4948-976e-eef9a36a621c","html_url":"https://github.com/aaPanel/btShieldML","commit_stats":null,"previous_names":["aapanel/btshieldml"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/aaPanel/btShieldML","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aaPanel%2FbtShieldML","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aaPanel%2FbtShieldML/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aaPanel%2FbtShieldML/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aaPanel%2FbtShieldML/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aaPanel","download_url":"https://codeload.github.com/aaPanel/btShieldML/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aaPanel%2FbtShieldML/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262444708,"owners_count":23312211,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-01T05:08:39.921Z","updated_at":"2025-06-28T14:31:11.286Z","avatar_url":"https://github.com/aaPanel.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"https://www.bt.cn/static/new/images/logo_03.svg\" alt=\"btShieldML \" width=\"300\"/\u003e\n\u003c/div\u003e\n\n\u003ch1 align=\"center\"\u003e堡塔木马查杀引擎\u003c/h1\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n[![btShieldML](https://img.shields.io/badge/go-1.22-blue)](https://github.com/aaPanel/btShieldML)[![openresty](https://img.shields.io/badge/License-AGPLv3-blue)](https://github.com/aaPanel/btShieldML/blob/main/LICENSE)[![version](https://img.shields.io/github/v/release/aaPanel/btShieldML.svg?color=blue)](https://github.com/aaPanel/btShieldML)[![social](https://img.shields.io/github/stars/aaPanel/btShieldML?style=social)](https://github.com/aaPanel/btShieldML)\n\n\u003c/div\u003e\n\n## 堡塔木马查杀引擎bt-ShieldML\n\u003e **免费的木马查杀引擎** bt-ShieldML是一款基于机器学习的堡塔木马查杀引擎，主要针对Web服务器环境中的恶意代码文件进行检测。 项目第一阶段聚焦于PHP文件的检测，后续将扩展支持更多语言，引擎将以Go语言实现，并编译为独立可执行文件，可集成到堡塔面板功能或作为独立工具使用。 **安装即可使用！**\n\n公开内容\n- 详细的模型训练过程\n- GO程序核心源码\n\n当前支持\n- php文件检测\n- 支持常见PHP webshell变种、混淆及加密技术识别\n- 提供文件级别和目录级别的批量扫描\n\n发展规划\n- 将扩展支持ASP、JSP等多语言webshell检测\n- 持续优化检测引擎，新增深度学习预测模型\n\n## 功能介绍\n###  堡塔木马查杀工作原理图\n\u003cp align=\"center\"\u003e\n    \u003cimg width=\"1986\" alt=\"image\" src=\"https://github.com/aaPanel/btShieldML/blob/main/img/Checking.png?raw=true\"\u003e\n\u003c/p\u003e\n\n### AST通信逻辑图\n\n\u003cp align=\"center\"\u003e\n    \u003cimg width=\"1986\" alt=\"image\" src=\"https://github.com/aaPanel/btShieldML/blob/main/img/ast.png?raw=true\"\u003e\n\u003c/p\u003e\n\n##  安装指南\n### 第一种方法：docker容器搭建\n方案1：可以在终端拉取镜像，然后直接访问http://ip:6528/shieldml_scan.html\n```\ndocker run -d \\\n  --name btshieldml \\\n  -p 6528:6528 \\\n  btpanel/btshieldml:latest\n```\n\n方案2：到面板的docker应用商店下载，搜索\"btshieldml\",点击安装即可\n\n流程：Docker-\u003e应用商店-\u003e搜索\"btshieldml\"-\u003e点击安装即可\n\n\n### 第二种方法：直接下载编译好的二进制文件\n\n\n### 第三种方法：编译源码\n\u003e 编译环境：Go 1.22 + Linux系统\n\n第一步：安装依赖环境\n```\ngo get github.com/CyrusF/libsvm-go\ngo get github.com/CyrusF/go-bayesian\ngo get github.com/grd/stat\napt install xxd\napt install libyara-dev\n```\n\n安装yara4.3+环境\n```\n# 在Debian系统安装YARA 4.3\nwget https://github.com/VirusTotal/yara/archive/refs/tags/v4.3.1.tar.gz\ntar -xzf v4.3.1.tar.gz\ncd yara-4.3.1\n./bootstrap.sh\n./configure --enable-static\nmake\nsudo make install\n\n# 安装开发依赖\nsudo apt-get install libssl-dev libmagic-dev jansson-dev\n\n# 刷新动态库缓存\nsudo ldconfig\n```\n\n\n第二步：进入根目录，编译php-bridge\n```\ncd bt-ShieldML \u0026\u0026 go mod tidy\nmake -C php-bridge\n```\n\n第三步：执行build.sh的脚本,需要把yara的静态库编译进去\n```\nbash build.sh\n```\n\n\n\n\n## 使用方法\n基本命令行用法\n```\n./bt-shieldml -path /path/to/scan  # 终端输出\n./bt-shieldml -path /path/to/scan -format json # 输出JSON格式文件，默认data目录下\n./bt-shieldml -path /opt/WebshellDet/sample/webshell/tennc/PHP/ -output report.html  # 输出HTML格式文件\n```\n\n\n案例说明\n```\n测试1: 目录测试\n./bt-shieldml -path  /opt/WebshellDet/sample/webshell/tennc/PHP/\n\n测试2:单文件测试\n./bt-shieldml -path  /opt/WebshellDet/sample/webshell/tennc/PHP/php/b374k/b374k-2.3.min.php\n\n测试3:输出html报告\n./bt-shieldml -path /opt/WebshellDet/sample/webshell/tennc/PHP/ -output report.html\n```\n\n\u003cp align=\"center\"\u003e\n    \u003cimg width=\"1986\" alt=\"image\" src=\"https://github.com/aaPanel/btShieldML/blob/main/img/report.png?raw=true\"\u003e\n\u003c/p\u003e\n\n## web检测平台编译\n\u003e 默认是6528端口，可支持修改\n\n前面的build.sh已经编译过了，这里直接运行\n```\n./shieldml_server\n```\n访问 http://服务器ip:6528/shieldml_scan.html 即可\n\u003cp align=\"center\"\u003e\n    \u003cimg width=\"1986\" alt=\"image\" src=\"https://github.com/aaPanel/btShieldML/blob/main/img/webserver.png?raw=true\"\u003e\n\u003c/p\u003e\n\n\n## 在线演示(Demo)\n敬请期待……\n\n## 许可证信息\n该项目是开源的，可根据AGPLv3协议使用。\n\n## 联系我们\n\u003e1. GitHub Issue \n\u003e2. QQ群1：922160183   QQ群2：709033027\n\n\n## 星趋势\n\u003e 欢迎关注我们的项目，我们会持续更新和优化项目。\n\n[![Star History Chart](https://api.star-history.com/svg?repos=aaPanel/btShieldML\u0026type=Date)](https://www.star-history.com/#aaPanel/btShieldML\u0026Date)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faapanel%2Fbtshieldml","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faapanel%2Fbtshieldml","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faapanel%2Fbtshieldml/lists"}