Deep integrated learning model construction method for malicious WebShell detection

Abstract

The invention relates to a deep integrated learning model construction method for malicious WebShell detection, and the method comprises the following steps: acquiring normal samples and malicious WebShell samples, randomly disorganizing the normal samples and the malicious WebShell samples, and dividing the normal samples and the malicious WebShell samples into a training set and a test set according to a proportion of 4: 1; extracting dynamic features and static features of each sample in the training set and the test set, and combining the dynamic features and the static features to obtain a training set feature set and a test set feature set; selecting m base classifiers, and training a deep integrated learning model by using the training set feature set and a K-fold cross validation method to obtain a weight value of each base classifier; and performing model testing by using the test set feature set as the input of the deep integrated learning model to obtain a comprehensive average prediction probability value of a test set sample, and evaluating the deep integrated learning model. The method is based on deep ensemble learning, the detection rate can be improved, and the advantages between machine learning and deep learning can be perfectly absorbed.

Description

Technical field [0001] The present invention relates to the field of Internet technology, and more particularly to a depth integrated learning model construction method for malicious WebShell detection. Background technique [0002] With the rapid development of the Internet, people can get all items that they are booking online, this lifestyle will spread a lot of personal information on various networks, leading to major Internet companies to store and protect them. Data became a big problem. Recently, a large number of hackers use some means that illegally obtain these data for perennial, the most common way to obtain database information for uploading a variety of malicious script files to obtain private information. How to find these malicious files from normal files into a big problem. Among them, the most common malicious PHP files in the website developed in PHP. Therefore, there is a need to malicious PHP file detection method to help web administrators quickly find mali...

AI Technical Summary

Problems solved by technology

[0006] C: The machine learning model in the detection of WebShell samples is too simple and the detection rate is not high; the deep learning model is too complex and the detection rate is high, but there is no interpretability

Images