Webshell detection method based on incremental learning, terminal equipment and storage medium

Abstract

The invention relates to a webshell detection method based on incremental learning, terminal equipment and a storage medium, and the method comprises: S1, collecting a webshell sample and a normal sample, carrying out the feature extraction of the samples, and forming a training set; S2, constructing a classification model, and training the classification model through the training set to obtain atrained initial classification model; S3, continuously collecting webshell samples, extracting feature vectors of the samples to form a newly added sample set, and performing incremental learning onthe initial classification model through the samples in the newly added sample set to obtain a classification model after incremental learning; and S4, detecting the webshell through the classification model after incremental learning. A set of marked samples and unmarked samples are utilized, the sample feature vectors are obtained by analyzing the sample abstract syntax tree to obtain the word set vectors, manual marking is not needed, the word set vectors and the minimum distance classification algorithm based on adjustment screening are utilized, an initial model can be obtained only through a small number of samples, and the labor cost is greatly reduced.

Description

technical field [0001] The invention relates to the field of network security detection, in particular to a webshell detection method based on incremental learning, a terminal device and a storage medium. Background technique [0002] With the rapid development of the Internet and the wide application of Web technology in various industries, Web security has gradually become one of the most important offensive and defensive battlefields in the field of information security. WebShell is a common web attack technology, which is implanted into web applications by attackers through file uploading, SQL injection and other attack methods. It is often used for attack purposes such as authority maintenance, data theft, and intranet detection. Scanners and website backdoors (aka WebShells) have become the most common web attack techniques used by attackers. Therefore, fast and accurate WebShell detection is particularly important on the security defense side. [0003] The tradition...

AI Technical Summary

Problems solved by technology

In the field of webshell security detection, due to the lack of samples, it is difficult to establish an accurate supervised learning model, and unsupervised learning will cause a high false alarm rate, requiring a large number of security engineers to analyze and filter machine learning warnings, and there are manual errors in the analysis results

Due to the variety of web attack methods, traditional prediction methods are difficult to deal with complex real environments

Images