PHP type WebShell detection method and detection system thereof

Abstract

The invention relates to the technical field of Internet security, in particular to a PHP type WebShell detection method and a detection system thereof. According to the method , normal sample files with php as the type and WebShell samples with php as the type are collected, and dynamic features and static features of the normal sample files and the WebShell samples are jointly used as features of a data set, so that the completeness of a feature library is improved; secondly, feature vectorization is carried out on the dynamic features by using Word2Vec, and numeralization is carried out on the basis of ensuring feature meanings; secondly, feature screening is performed by using a random forest, unimportant features are moved, important classification features are reserved, and the time and space complexity is reduced for a subsequent classification algorithm; and finally, an ensemble learning algorithm is used for classification, so that the advantages of each classification algorithm can be improved to a great extent, and finally, very high accuracy and recall rate can be obtained.

Description

technical field [0001] The invention relates to the technical field of Internet security, in particular to a PHP-type WebShell detection method and a detection system thereof. Background technique [0002] The network backdoor obtains server data information or system administrator rights through shell scripts, and further extends the damage to the entire local area network, causing the entire server to be paralyzed. It can also obtain information by hanging horses on the website, spreading viruses, etc.; For security, it is extremely important to detect backdoor files on the server, and malicious WebShell is a kind of website backdoor, so it is extremely important to detect WebShell files on the website. [0003] According to the type of scripting language, WebShell can be classified into ASP script Trojan horse, PHP script Trojan horse, JSP script Trojan horse, etc., and among the known WebShells, WebShell written in PHP accounts for a large proportion, and WebShell script...

AI Technical Summary

Problems solved by technology

[0005] (1) The feature database is not perfect;

[0006] (2) The meaning of the feature cannot be fully interpreted after feature vectorization;

[0007] (3) The feature dimension is too high, and the space complexity of the classification algorithm is extremely high;

[0008] (4) The classification algorithm has certain limitations

Images