在网络安全攻防对抗中，攻击者经常通过在系统关键组件中植入后门程序，来获取持久的访问权限。sshd (SSH daemon) 作为管理远程登录的核心服务，是攻击者常用的目标之一。攻击者通过修改或者替sshd二进制文件，绕过原有身份认证机制。这样，他们就能获取对服务器的控制权，并实施各种恶意攻击。

然而，sshd后门的隐蔽性极强。攻击者通常仅对某个身份认证函数进行细微改动，例如增加特定的后门密码条件判断。这些改动往往形式多样，不同攻击者可能采用不同的后门密码，使得传统检测方法面临巨大挑战。

• 杀毒软件：主流杀毒软件依赖特征码匹配，擅长检测已知的恶意软件模式，如特定字符串、字节序列等。然而，sshd后门的修改往往是语义层面的微小变化，难以通过通用规则进行有效检测，从而难以应对变种后门的识别。

• 白名单机制：基于sshd白名单的检测方法虽然能够有效防范后门，但在动态业务环境中，由于sshd版本更新、补丁发布或正常业务逻辑引入，可能导致误报。这不仅影响正常用户的使用体验，也使得白名单的维护成本显著增加。

• 人工分析：依赖安全专家进行人工分析虽然能够准确识别后门样本，但分析过程耗时且成本高昂，难以满足大规模服务器集群的检测需求。

SSHD_AUTH_FUNCTIONS = {"ssh_xmss_equal", "input_userauth_info_response", "auth2_challenge_start","ssh_gssapi_accept_ctx", "user_key_allowed2", "hostbased_key_allowed","mm_ssh_gssapi_server_ctx", "mm_answer_keyverify", "auth_password","userauth_kbdint", "mm_auth_password", "mm_answer_authpassword","sshkey_equal_public", "input_gssapi_token", "mm_answer_pwnamallow","gss_accept_sec_context", "mm_user_key_allowed", "check_hostkeys_by_key_or_type","ssh_ed25519_sk_equal", "ssh_xmss_verify", "ssh_dss_equal","auth_check_authkey_line", "mm_request_send", "mm_sshkey_verify","sshkey_sk_fields_equal", "mm_answer_gss_accept_ctx", "userauth_passwd","input_userauth_request", "ssh_ecdsa_sk_verify", "userauth_gssapi","sshkey_equal", "ssh_rsa_equal", "sshkey_verify","sys_auth_passwd", "userauth_hostbased", "userauth_pubkey","auth2_challenge", "mm_hostbased_key_allowed", "getpwnamallow","user_key_allowed", "check_key_in_hostkeys", "ssh_rsa_verify","ssh_ecdsa_sk_equal", "ssh_ed25519_sk_verify", "sshkey_read","mm_getpwnamallow", "mm_answer_keyallowed", "ssh_dss_verify","check_key_in_hostfiles", "ssh_ecdsa_verify", "userauth_finish","ssh_ed25519_equal", "ssh_ed25519_verify", "userauth_none","ssh_ecdsa_equal", "mm_ssh_gssapi_accept_ctx", "auth_check_authkeys_file","cert_compare", "mm_key_allowed", "auth_krb5_password","sshpam_auth_passwd", "do_authentication", "do_authloop"}