Automatic and Accurate Detection of Webshell Based on Convolutional Neural Network

Abstract

The rapid development of the Internet has changed the way people live and work. Web security, as the foundation of network security, has received much more attention. Based on the variability of Webshells and the vulnerability of detection methods, this paper proposed a model that used deep learning to detect and implements the automatic identification of Webshells. For the shortcomings of the traditional detection models using machine learning algorithms, this paper proposed to apply convolutional neural network to Webshell detection process. The deep learning model does not require complicated artificial feature engineering, and the modeled features trained through model learning can also allow the attacker to avoid targeted bypassing in Webshell detection. The experimental results showed that this method not only has better detection accuracy, but also can effectively avoid the attacker's targeted bypassing. At the same time, with the accumulation of training samples, the detection accuracies of the detection model in different application environments will gradually improvements, which has clear advantages over traditional machine learning algorithms.

BERT-Embedding-Based JSP Webshell Detection on Bytecode Level Using XGBoost

“…Machine learning and deep learning methods [25][26][27] are used in webshell detection. Among the deep learning methods used, CNN [28][29][30] is often used for webshell detection. Tian et al [31] first applied CNN to webshell detection.…”

Session-Based Webshell Detection Using Machine Learning in Web Logs

“…is is the oldest and most traditional way to detect webshells, which places high demands on the administrators of the website. Administrators are supposed to have a comprehensive grasp of the website files and have a high recognition ability for some newly added exception files [13], such as some naming files, passby.php, pass.asp, and a.jsp. Besides, these small files should be treated carefully because there are probably one word Trojans.…”

Enhancing the Feature Profiles of Web Shells by Analyzing the Performance of Multiple Detectors

“…Since only one path in the code sequences of a malicious sample may be malicious, there is considerable interference by non-malicious paths on the features. This also explains why researchers have suggested that the Doc2Vec detection performance is below par [6].…”

“…Analysis of the hash values revealed that a little over one-half of the malicious samples (1,031 samples) were included in the benign samples. Manual analysis of the 1,031 samples revealed that they were, in fact, benign -this raises questions about the results presented by researchers who have used these datasets [4,6,14]. In any case, these 1,031 samples were eliminated to leave only 1,019 malicious samples.…”