Webshell detection method based on deep neural network, and system thereof

A technology of deep neural network and detection method, which is applied in the field of WebShell detection method and system of recursive neural network, which can solve problems such as false positives and high overhead
CN107516041AActive Publication Date: 2017-12-26BEIJING ANPRO INFORMATION TECH
3 Cites 53 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
BEIJING ANPRO INFORMATION TECH
Publication Date
2017-12-26

Smart Images

  • Figure 1
    Figure 1
  • Figure 2
    Figure 2
  • Figure 3
    Figure 3
Patent Text Reader

Abstract

The invention discloses a Webshell detection method based on a deep neural network, and a system thereof. A recursion loop neural network based on an abstract syntax tree automatically obtains the morphology and grammar information of a script by aiming at a script language, the hierarchical structure characteristics of the abstract syntax tree is used for finishing feature abstraction and WebShell detection, including preprocessing, sample generation and WebShell detection; firstly, the morphology and grammar information of the script is automatically obtained, and then, the recursion loop neural network based on the abstract syntax tree is used for finishing the feature abstraction and the WebShell detection. The method disclosed by the invention has the advantages of being low in deployment cost, good in portability and high in detection accuracy.
Need to check novelty before this filing date? Find Prior Art

Description

technical field

[0001] The invention relates to the technical field of information security, in particular to a WebShell detection method based on an abstract syntax tree-based recursive cyclic neural network and a system thereof. Background technique

[0002] WebShell is a command execution environment that exists in the form of web pages, and is often used by intruders as a backdoor tool for operating web servers. The attacker obtains the management authority of the Web service through the WebShell, thereby achieving the penetration and control of the Web application.

[0003] Since the characteristics of WebShell and ordinary Web pages are almost the same, it can evade the detection of traditional firewalls and antivirus software. Moreover, with the application of various anti-detection feature obfuscation and concealment technologies to WebShell, it is difficult to detect new variants in a timely manner by traditional detection methods based on signature matching. [0...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More