Improving Convolutional Neural Network-Based Webshell Detection Through Reinforcement Learning

Wu, Yalun; Ming, Song; Li, Yike; Tian, Yunzhe; Tong, Endong; Niu, Wenjia; Jia, Bowei; Huang, Haixiang; Li, Qiong; Liu, Jiqiang

doi:10.1007/978-3-030-86890-1_21

Cited by 6 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To demonstrate the effectiveness of our approach, we compare SAWD with a range of state-of-the-art webshell detection systems on our collected dataset. We use NeoPI [14] source code files and use support vector machines (SVM), random forests (RF), and multi-layer perception (MLP) as the classifier. The opcode-based methods [15] adopt FastText to obtain the vectorized features of the opcode sequence, which is input into three machine learning algorithms for webshell detection.…”

Section: Comparison With Other Methods (To Rq3)mentioning

confidence: 99%

SAWD: Structural-Aware Webshell Detection System with Control Flow Graph

Zhu,

Yao,

Deng

et al. 2023

International Conferences on Software Engineering and Knowledge Engineering

View full text Add to dashboard Cite

With the increasing prevalence of web servers, protecting them from cyber attacks has become a crucial task for online service providers. Webshells, which are backdoors to websites, are commonly used by hackers to gain unauthorized access to web servers. However, traditional methods for detecting webshells often fail to produce satisfactory results due to the use of obfuscation or encryption to conceal their characteristics. In recent years, webshell detection methods based on deep learning (DL) have received significant attention, but they struggle to preserve the syntax and semantic information contained in the source code. In this paper, we propose a structuralaware webshell detection system to address these problems, denoted as SAWD. Specifically, we first generate the control flow graph (CFG) with syntax and semantic information from the PHP source code. Then, we leverage CFG to build our graph representation, which consists of the adjacency matrix and keywords-based basic block features. Finally, based on our graph representation, we adopt convolutional neural networks (GCN) combined with graph pooling to detect webshells more efficiently. Experimental results demonstrate that our method outperforms state-of-the-art webshell detection systems on the collected dataset.

show abstract

Section: Comparison With Other Methods (To Rq3)mentioning

confidence: 99%

SAWD: Structural-Aware Webshell Detection System with Control Flow Graph

Zhu,

Yao,

Deng

et al. 2023

International Conferences on Software Engineering and Knowledge Engineering

View full text Add to dashboard Cite

show abstract

“…Dynamic detection is usually based on the detection of web traffic [10]. For instance, Wu et al [11] employ reinforcement learning to determine whether the web traffic originates from a webshell. However, while dynamic detection can give real-time detection, it also uses a significant amount of system resources.…”

Section: Methods Of Webshell Detectionmentioning

confidence: 99%

BERT-Embedding-Based JSP Webshell Detection on Bytecode Level Using XGBoost

Xing

Zhang

et al. 2022

Security and Communication Networks

View full text Add to dashboard Cite

Webshell is a malicious program that might result in data theft, file modification, or other damaging behaviors once uploaded to a server. Detecting webshells is a key security concern for website administrators. In recent years, techniques such as obfuscation and encryption have been deployed on webshell technology, and classic detection approaches such as static feature matching are gradually underperforming on webshell detection. Meanwhile, there are variations between languages such as JSP and PHP, and researchers have proposed webshell detection methods primarily for languages such as PHP. At the same time, there are fewer detection techniques for JSP webshells. In this case, a detection approach for the JSP webshells is needed. This paper provides a novel webshell detection model for the JSP language. The model’s fundamental premise is that it introduces the BERT-based word vector extraction method, which has been shown in experiments to be more effective at detecting obfuscation, encryption, and other means of evading detection than the traditional Word2vec word vector extraction method. Meanwhile, we introduce the XGBoost algorithm as the model classifier. The experimental results reveal that present model has achieved 99.14% accuracy, 98.68% precision, 98.03% recall, and 98.35% f1 score, and the overall effect is better than the already existing JSP webshell detection approaches.

show abstract

“…As neural networks have achieved remarkable results in the field of natural language processing, and the nature of the Webshell detection task is a special text binary classification task, there are many researchers applying neural networks to Webshell detection. For instance, Zhou et al employed Long Short-Term Memory networks for Webshell detection [27]; Lv et al utilized convolutional neural networks [11]; and Wu et al leveraged reinforcement learning to enhance CNNs in Webshell detection [13]. Liu et al achieved Webshell detection across multiple languages through the use of Bidirectional Gated Recurrent Unit networks and attention mechanisms [28].…”

Section: Related Wordmentioning

confidence: 99%

“…Simultaneously, researchers have directed their attention towards the scrutiny of Webshell files, embarking on the extraction of static or abstract features [10] inherent in these files. Subsequently, machine learning or neural network methodologies are employed for the discernment of Webshells based on these extracted features [11][12][13][14]. However, a critical challenge in the Webshell detection landscape arises during the stage of Webshell placement.…”

Section: Introductionmentioning

confidence: 99%

AST-DF: A New Webshell Detection Method Based on Abstract Syntax Tree and Deep Forest

Dong,

2024

Electronics

View full text Add to dashboard Cite

Webshell is a kind of web-language-based website backdoor, which is usually used by attackers to control web servers. Due to its dangerous nature, how to detect Webshell effectively has become a hot research topic in current Web security research. With the rapid development of Webshell evasion technology, the existing Webshell detection methods have the problem of insufficient ability to detect unknown Webshells. In order to solve the above problems and achieve effective Webshell detection, this study proposes a Webshell detection method based on the abstract syntax tree (AST) and deep forest (DF) model called AST-DF. AST-DF first extracts the abstract syntax tree from the PHP code; then, the abstract syntax tree sequence is feature extracted and vectorized using N-gram and TF-IDF. Finally, the vectors are imported into the deep forest model for classification to determine whether the PHP code to be detected is a Webshell or not. The experimental results show that AST-DF achieves remarkable effects in the task of detecting PHP-type Webshells, with a 99.61% accuracy rate, and the values of precision, recall, and F1 score are more than 99%.

show abstract

Improving Convolutional Neural Network-Based Webshell Detection Through Reinforcement Learning

Cited by 6 publications

References 22 publications

SAWD: Structural-Aware Webshell Detection System with Control Flow Graph

SAWD: Structural-Aware Webshell Detection System with Control Flow Graph

BERT-Embedding-Based JSP Webshell Detection on Bytecode Level Using XGBoost

AST-DF: A New Webshell Detection Method Based on Abstract Syntax Tree and Deep Forest

Contact Info

Product

Resources

About