SAWD: Structural-Aware Webshell Detection System with Control Flow Graph

Abstract

With the increasing prevalence of web servers, protecting them from cyber attacks has become a crucial task for online service providers. Webshells, which are backdoors to websites, are commonly used by hackers to gain unauthorized access to web servers. However, traditional methods for detecting webshells often fail to produce satisfactory results due to the use of obfuscation or encryption to conceal their characteristics. In recent years, webshell detection methods based on deep learning (DL) have received significant attention, but they struggle to preserve the syntax and semantic information contained in the source code. In this paper, we propose a structuralaware webshell detection system to address these problems, denoted as SAWD. Specifically, we first generate the control flow graph (CFG) with syntax and semantic information from the PHP source code. Then, we leverage CFG to build our graph representation, which consists of the adjacency matrix and keywords-based basic block features. Finally, based on our graph representation, we adopt convolutional neural networks (GCN) combined with graph pooling to detect webshells more efficiently. Experimental results demonstrate that our method outperforms state-of-the-art webshell detection systems on the collected dataset.