Webshell detection method, storage medium and system

Abstract

The invention provides a Webshell detection method. The Webshell detection method comprises the following steps: acquiring a plurality of detected php files and a to-be-detected php file, and carrying out opcode intermediate code sequence conversion; performing Webshell text feature extraction on each first opcode intermediate code sequence and each second opcode intermediate code sequence; thirdly, conducting PHP code data flow controllable feature extraction on the multiple detected php files and the to-be-detected php file; constructing a feature matrix and inputting the feature matrix into a neural network for training; and inputting the second Webshell text feature and the second PHP code data flow controllable feature into the trained neural network to carry out Webshell detection. The invention further provides a storage medium and a system. According to the method, the accuracy of the Webshell detection result can be improved, and the false alarm rate is low.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a Webshell detection method, a storage medium and a system. Background technique [0002] Webshell is a web backdoor based on web services. Attackers upload webshells to the background server of the website to achieve the purpose of stabilizing the web server and post-infiltration. With the continuous improvement of network security awareness, research on Webshell detection has become one of the current important tasks. [0003] The current webshell detection technology is mainly divided into static detection and dynamic detection technology. The static detection technology summarizes the static features of the webshell and then detects them based on these features. The earliest static detection method is to use regular expressions for matching, but because of the continuous deformation of the Webshell, the regular expressions need to be updated continuously...

AI Technical Summary

Problems solved by technology

Because these features are not unique to Webshell files; the latest neural network proposed uses PHP dynamic executable features as features for model training. For Webshell, it is not enough to only detect PHP dynamic executable features, and it cannot be determined dynamically. Executable Points are interactive via attacker input

Images