Webshell exists as a command execution environment in the form of a web page file, which is often referred to as a backdoor. After hacking a website, hackers usually upload it to the web directory of the web server and mix it with the normal web files, and then access the backdoor program through the browser, which can achieve the purpose of controlling the browser. Since there are many kinds of web backdoors in the form of asp, php, jsp or cgi files, here we choose the more popular php file as the research object. In this paper, the Webshell dataset comes from common Webshell samples on the Internet, and the white samples mainly use common open source software developed based on PHP. We use bag-of-words and TF-IDF models for feature extraction, and construct Webshell detection models based on the LightGBM algorithm. The results show that our model is more than 98% accurate and has higher performance in space and time compared to the current popular classification models.

In recent years, with the rapid development and rise of mobile Internet, network security issues have also posed a great threat to people. Botnets are an important problem faced by current network security. DNS protocol-based botnets widely use domain generation algorithm (DGA), which can randomly change the domain name to hide itself, and therefore is very likely to threaten people’s network security. In this paper, we use the domain names of the top 1 million websites in the Alexa global ranking as white samples, and for the DGA sample data, we use the open data of 360netlab as black samples. The character sequence model is used for feature extraction, and the LSTM with Bayesian optimization neural network is used to optimize the hyperparameter combination, which finally makes the accuracy of the model above 97%, and the model has superior performance to compare with the conventional model, which can effectively improve the accuracy of DGA detection and recognition.