Webshell detection method and apparatus based on deep learning and semi-supervised learning

Abstract

The invention provides a Webshell detection method and apparatus based on deep learning and semi-supervised learning. The method comprises the following steps: obtaining original training samples, selecting labeled samples to perform word segmentation processing, analyzing the correlation between feature words and labels by chi-square test, and selecting the previous K feature words with the strongest correlation as screening feature words; performing feature word screening on unlabeled samples by using the screening feature words to serve as unlabeled sample features; training the obtained unlabeled sample features by using a neural network algorithm to obtain text vectors of the unlabeled samples; training a single-class SVDD model by using an unsupervised method, and optimizing a hypersphere radius to the minimum, wherein the maximum case comprises the unlabeled samples; and for a new labeled sample, performing incremental training on the SVDD model by using an online learning method to correct the single-class SVDD model; and applying the latest model to the prediction of new samples. By adoption of the Webshell detection method and apparatus provided by the invention, the missing report rate and the false reporting rate of the traditional webshell detection can be effectively improved.

Description

technical field [0001] The invention relates to the technical field of webshell detection, in particular to a webshell detection method and device based on deep learning and semi-supervised learning. Background technique [0002] With the development of the Internet, Web applications based on B / S architecture are rapidly popularized, including applications in government, banks, operators, e-commerce, and major portal websites. Due to the differences in the level of R&D personnel of different Web systems, it is inevitable that security issues are not considered during the design process, resulting in frequent occurrence of Web security issues. Common security threats include: SQL injection vulnerabilities, file upload vulnerabilities, form submission vulnerabilities, cross-site scripting attacks, etc. After obtaining the vulnerability of the web system, the intruder will upload the web shell to obtain the operating authority of the web server. For intruders, Webshell is a b...

AI Technical Summary

Problems solved by technology

Since the webshell operation will not leave a record in the system security log and is mixed with normal webpage files, it is difficult for general administrators to see traces of intrusion

[0003] In the field of web security detection, due to the lack of samples, it is difficult to establish an accurate supervised learning model, and unsupervised learning will cause a high false alarm rate, requiring a large number of security engineers to analyze and filter machine learning warnings, and there are manual errors in the analysis results

Due to the variety of web attack methods, traditional prediction methods are difficult to deal with complex real environments

Images