Enhancement method and system for performing Webshell detection based on Bert model
By extracting dynamic eigenvectors from bytecode and using the combination of Bert model and XGBoost classification model, the problem of obfuscated code interference in Webshell detection is solved, achieving higher detection accuracy.
Patent Information
- Application Number
- CN202510474098.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-16
- Publication Date
- 2025-08-01
AI Technical Summary
The existing Webshell detection scheme based on Bert model is unclear in the data acquisition data feature vector, and is easily disturbed by obfuscated code, resulting in a decrease in detection accuracy.
The Webshell detection route based on the Transformer architecture model is adopted, and the dynamic feature vector is extracted from the bytecode as input. The bytecode is extracted from the Webshell script file through the Vulcan Logic Disassembler tool. The dynamic subword vector is generated using the transformer encoder in the Bert model, and combined with XGBoost as the classification model for detection.
Reduces the impact of obfuscated code, can better detect WebShell variants, significantly improving the detection accuracy.
Smart Images
Figure CN120408637A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the fields of network security and artificial intelligence technologies, and particularly relates to an enhanced method for detecting Webshells based on the Bert model. Background Art
[0002] A Webshell is a script program uploaded using server vulnerabilities, which provides an attacker with an interface for remotely controlling an infected server. These scripts are usually written in PHP, ASP, JSP, or other dynamic web languages, can run on a web server, and allow attackers to interact with the server through a web interface to perform operations such as file management and command execution. The Webshell was initially designed to facilitate remote management by website administrators, but due to its powerful functions, it has also been widely used by hackers as a backdoor tool after invading a website. Attackers upload the Webshell to the server by discovering and exploiting vulnerabilities in web applications, such as file upload vulnerabilities and code injection, thereby gaining control of the server. Once the Webshell is implanted, it can serve as a persistent backdoor, enabling attackers to access the infected system for a long time to carry out malicious activities such as data theft, privilege escalation, and lateral movement.
[0003] Currently, the technical routes implemented in the field of improving the accuracy of Webshell detection are mainly divided into four types: combined detection of script static and dynamic features, machine learning algorithm detection, deep learning algorithm detection, and Transformer architecture model detection. Among them, the combined detection scheme of script static and dynamic features is a detection method that extracts static and dynamic features at the code level to improve the detection accuracy; the machine learning and deep learning detection schemes use classification algorithms for the input features to detect the pre-trained model to improve the detection accuracy; the Transformer architecture model detection scheme is based on the input features and detects based on the attention mechanism to understand the behavior of the feature vector in the context to improve the detection accuracy.
[0004] Among them, on the technical route of detection based on the Transformer architecture model, the currently most representative and widely applied technical solution is the Bert model detection.
[0005] Bert (Bidirectional Encoder Representations from Transformers) is a pre-trained deep learning model based on the Transformer architecture, proposed by Google in 2018. It can understand the meaning of words in their context, and it adopts a bidirectional training method, which makes it have a wide range of application scenarios in the field of natural language processing, including public opinion analysis, code understanding, natural language inference, etc. As shown in the appendix Figure 1 As shown, the Bert model mainly consists of three layers, including an input layer, an encoding layer, and an output layer. In the encoding layer, the Bert model mainly adopts the Transformer architecture. As shown in the appendix Figure 2 As shown, it includes: input representation, word vector position encoding, multi-head self-attention mechanism, residual connection and layer normalization, position-wise feed-forward neural network, softmax activation function, etc. In this disclosure, by extracting feature vectors from bytecode as input, only the technical solutions of the input representation part of the input layer and the encoding layer of the Bert model are introduced.
[0006] Currently, the Webshell detection scheme based on the Bert model is not clear about the data collection data feature vectors, and may be interfered by factors such as obfuscated code, resulting in a decrease in the detection accuracy. Summary of the Invention
[0007] This disclosure provides an enhanced method for detecting Webshell based on the Bert model. It adopts a Webshell detection route based on the Transformer architecture model, extracts dynamic feature vectors from bytecode as the input form, reduces the interference of code obfuscation, and can detect as many variants of the samples as possible, thereby improving the detection accuracy of WebShell.
[0008] The enhanced method for detecting Webshell based on the Bert model provided by this disclosure is mainly characterized in that:
[0009] (1) Using the intermediate state bytecode of the code as the dataset
[0010] WebShell is usually malicious code written in a scripting language, aiming to be uploaded to the server and perform malicious operations. People who write WebShell sometimes use obfuscation techniques to hide the true intention of the code, making security detection more difficult. However, obfuscation usually only affects the presentation form of the source code and does not change its execution logic. Therefore, by analyzing the intermediate state bytecode of the code, the influence brought by obfuscation can be ignored.
[0011] (2) Using the Transformer architecture model to generate dynamic word vectors
[0012] Variants of WebShell refer to those that are modified in certain parts to be different from the original version but still retain their malicious functions. To cope with this change, using the Transformer architecture can help capture the dynamic meaning of the vocabulary in the code.
[0013] Specifically, it includes the following steps:
[0014] S1. Extract bytecode from the script to be detected;
[0015] S2. Use the obtained bytecode as a dataset and utilize the transformer encoder in the Bert model to generate dynamic sub-word vectors based on the context data;
[0016] S3. For the generated sub-word vectors, use a grouping model to detect WebShell.
[0017] Furthermore, the specific steps of step S1 include:
[0018] S11. Perform lexical analysis on the WebShell script file;
[0019] S12. Perform syntax analysis to generate an abstract syntax tree;
[0020] S13. Read the abstract syntax tree and convert the operation nodes into corresponding bytecodes.
[0021] Furthermore, in step S1, the Vulcan Logic Disassembler tool is used to extract bytecodes from the PHP code of the WebShell script file.
[0022] Furthermore, the specific steps of step S2 include:
[0023] S21. Tokenizer: Perform sub-word segmentation on the bytecode;
[0024] S22. Embed the separator [CLS] in the BERT structure into the bytecode after sub-word segmentation;
[0025] S23. Embeddings: Input the result of step S22 into the transformer encoder in the Bert model to obtain the sub-word vector corresponding to the [CLS] symbol, which is used as the semantic representation of the entire text in the classification task.
[0026] Furthermore, the specific method of step S21 includes:
[0027] Each word in the bytecode is traversed forward from the last letter, and at each traversal, it is determined whether the substring from the first letter to the current position is in the vocabulary;
[0028] If so, divide the current word into two sub-words from the traversed position, and repeat the previous steps for each sub-word;
[0029] If the segmented sub-word is not the starting part of the unsegmented word, prefix it with "##" to assist in recombination during the decoding process.
[0030] Furthermore, in step S3, the webshell detection is regarded as a binary classification problem, and XGBoost is used as a classification model to classify the generated sub-word vectors.
[0031] An enhanced system for webshell detection based on the Bert model applying the above method mainly includes:
[0032] Bytecode extraction module, used to extract bytecode from the script to be detected;
[0033] Bert encoding module, used to use the obtained bytecode as a data set, and utilize the transformer encoder in the Bert model to generate dynamic sub-word vectors based on context data;
[0034] Webshell detection module, for the generated sub-word vectors, use the grouping model to perform webshell detection.
[0035] Compared with the prior art, the beneficial effects of the present disclosure are: ① Extracting dynamic features from bytecode reduces the influence of obfuscated code; ② Can detect as many variants of the sample as possible; ③ Effectively improve the accuracy of WebShell detection. Brief Description of the Drawings
[0036] By describing the exemplary embodiments of the present disclosure in more detail in conjunction with the accompanying drawings, the above and other objects, features, and advantages of the present disclosure will become more obvious. Among them, in the exemplary embodiment mode of the present disclosure, the same reference numerals generally represent the same components.
[0037] Figure 1 It is a schematic diagram of the Bert architecture;
[0038] Figure 2 It is a technical framework diagram of Transformer;
[0039] Figure 3 It is a schematic diagram of a specific network scenario applied by the detection engine device;
[0040] Figure 4 It is a process example of converting a Webshell script into bytecode;
[0041] Figure 5 It is a schematic diagram of sub-word vector extraction. Detailed Description of the Specific Embodiment
[0042] Preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.
[0043] The present disclosure mainly provides a new technical solution for the input representation of Webshell detection based on the Bert model. This solution is mainly proposed for WEB service operations, so it is first necessary to describe the specific network scenarios in which the detection engine device is applied.
[0044] In an exemplary embodiment, as shown in the attached Figure 3 figures, the deployment scenario of the detection engine device has the following characteristics:
[0045] ● The detection engine device can be located bypassing the WEB service operation;
[0046] ● The detection engine can also be installed on the WEB service;
[0047] ● The detection engine device and the web server are network reachable;
[0048] ● The web server sends the file to be detected to the detection engine device for asynchronous detection.
[0049] The Webshell detection method according to the present disclosure includes the following steps:
[0050] 1. Convert the Webshell script to bytecode
[0051] In this embodiment, the Webshell script is written in PHP language. If the Webshell script is written in jsp language, it can be converted into a java class file through tomcat server or other java language tools and then the bytecode can be extracted. The operation process is not exactly the same but the idea is basically the same. For other languages that cannot generate an intermediate state, the same idea cannot be used to extract the bytecode.
[0052] PHP is a programming language that is directly executed by the PHP virtual machine at runtime. The PHP virtual machine used is the Zend Engine, which is the core component of the PHP interpreter. It is responsible for compiling PHP code into an executable instruction set and interpreting and executing these instructions at runtime. In addition, the Zend Engine also supports Just-In-Time (JIT) technology, which allows PHP code to be directly compiled into machine code at runtime to improve code execution performance. This enables the PHP virtual machine to execute PHP code faster and more efficiently.
[0053] The process of executing PHP code is divided into three stages: lexical analysis, syntax analysis, and Zend Engine execution. The execution flow of the PHP code process is as Figure 4 .
[0054] The process of extracting bytecode from PHP code mainly includes:
[0055] (1) Lexical analysis
[0056] Lexical analysis refers to the process of converting a sequence of characters in a source code file into a series of tokens. This process helps the compiler or interpreter handle the code more conveniently. Usually, it is the initial stage of the compilation process, followed by syntax analysis and semantic analysis.
[0057] In lexical analysis, the source code is scanned character by character, and tokens are created by combining characters according to the rules of the programming language. These tokens represent the basic components of the program syntax, such as keywords, identifiers, punctuation marks, and constants.
[0058] The task of performing lexical analysis is carried out by a lexical analyzer, also known as a token generator. The result of this stage is a token stream, which can be processed more efficiently by the syntax analyzer to ensure the correct syntax and structure of the program.
[0059] (2) Syntax analysis, building an abstract syntax tree
[0060] Syntax analysis, or parsing, refers to the process of checking a sequence of symbols in a natural language or computer language based on predefined syntax rules. Its main goal is to evaluate whether the provided input conforms to the syntax rules of the language. In the context of natural language processing, syntax analysis plays a crucial role in understanding and interpreting sentence structure. This includes identifying various parts of speech (nouns, verbs, adjectives, etc.), establishing relationships between words (such as subject-verb agreement), and constructing a hierarchical representation of the sentence, which is called a parse tree or an abstract syntax tree (AST).
[0061] (3) Compiling to generate bytecode
[0062] After syntax analysis, the next step is the execution phase of the Zend engine, which compiles the bytecode by reading the Abstract Syntax Tree (AST) and converting the operation nodes into corresponding bytecodes, namely the so-called opcodes.
[0063] After that, there are two tools available for bytecode extraction: the VulcanLogic Disassembler (VLD) developed by Derick Rethans and the PHP debugger (phpdbg) as part of the PHP project. Among them, VLD can display the opcodes after a PHP script is compiled by the Zend engine, helping developers understand the execution flow and performance bottlenecks of PHP code; phpdbg is a PHP debugger that utilizes the Zend engine debugging interface and provides debugging functions for PHP scripts, such as setting breakpoints, stepping through, and viewing variable values.
[0064] The VLD tool works by reading a PHP file and then extracting the bytecode it contains. After successfully retrieving the bytecode, it will read the instructions in the bytecode and display the output in a more readable format. Meanwhile, the PHP debugger works by executing PHP code in debug mode. When the debug mode is activated, it will display the opcode instruction information of the PHP code execution, as well as variable values and other debugging information. Generally, the VLD tool is more suitable for analyzing PHP code, while the PHP debugger is more suitable for finding errors or vulnerabilities in PHP code.
[0065] In this embodiment, the VLD tool is used to extract PHP code into bytecode. For example, the following analysis is performed on the PHP code:
[0066]
[0067] The following opcode sequence is generated: [FETCH_R], [FETCH_DIM_R], [JMPZ], [FETCH_R], [FETCH_DIM_R], [INIT_FCALL], [ASSIGN], [SEND_VAR], [DO_ICALL], [ECHO], [RETURN].
[0068] 2. The tokenizer phase, also known as Word Segmentation, specifically includes operations such as normalizing the text to uppercase or lowercase and subdividing the text corpus into the smallest subwords according to the vocabulary.
[0069] After generating bytecode and before the encoding stage of the input BERT model, the bytecode must be converted into token IDs, and creating token IDs requires subword segmentation of the input text. For example, "unwanted" is decomposed into "un", "##want", and "##ed".
[0070] There are many algorithms that can be used for word segmentation. In BERT, Wordpiece is used as the tool for word segmentation, and its main algorithm is the greedy matching algorithm. The basic concept of the Wordpiece algorithm is: each word in the bytecode is traversed from the last letter forward, and at each traversal, it is determined whether the substring from the first letter to the current position is in the vocabulary. If it is, the current word is divided into two subwords from the traversed position, and the previous steps are repeated for each subword. If the segmented subword is not the start part of the unsegmented word, then it should be prefixed with "##" to help with recombination during the decoding process.
[0071] 3. Embedding delimiters
[0072] This embodiment proposes a method of applying the word embedding technology of BERT to PHP Webshell detection. In the BERT structure, [CLS] and [SEP] are two unique symbols. In binary classification tasks, [CLS] is added to the beginning of the sentence to indicate that this is a single-sentence classification task, and the [SEP] token is not added at the end of the sentence in binary classification tasks.
[0073] [SEP] indicates the separation of two sentences, and the corresponding encoding is 102; [CLS] is used in classification scenarios, and the semantics of the entire sentence can be represented at this position, and the corresponding encoding is 101.
[0074] BERT appropriately understands the input by leveraging the unique token [CLS]. The [CLS] token is unique. The output vector corresponding to the [CLS] symbol can be used as the semantic representation of the entire text in classification tasks because it contains the semantic information of each word in the text. After the original PHP file is converted into bytecode, it can be used to generate word vectors through BERT.
[0075] 4. BERT - Based Word Embeddings: That is, using the Transformer encoder to generate dynamic subword vectors.
[0076] Traditional word vector models, such as Word2vec, are ineffective in explaining polysemous words and it is difficult to distinguish their various meanings in different contexts. In 2018, Google proposed the BERT (Bidirectional Encoder Representations from Transformers) model, which is a pre-trained language representation model that uses a bidirectional transformer encoder for feature extraction to generate dynamic word vectors and can solve the problem of polysemy. At the same time, BERT can obtain different levels of features at different layers of the network through pre-training to better represent the complex attributes of words. When applied to some downstream tasks, BERT usually only needs simple fine-tuning to obtain good results.
[0077] The process of generating word vectors using the transformer encoder of the Bert architecture model is called Embedding. Embedding includes: Token Embedding, Position Embedding, and Segment Embedding.
[0078] Token Embedding: It is the process of converting each word into a vector after tokenizing the input text; Position Embedding: Since the Transformer architecture itself does not have a recursive or convolutional structure, it cannot naturally understand the order information of words in a sentence. To introduce this order information, BERT uses position embeddings, which are predefined according to the positions of words in the sentence, enabling the model to learn the order relationship between words; Segment Embedding: In some tasks such as question answering and natural language inference, the model needs to process the relationship between two sentences. The segment embedding is used to distinguish these two sentences, providing the model with information about which part belongs to the first sentence and which part belongs to the second sentence.
[0079] In this embodiment, Token Embedding, Position Embedding, and Segment Embedding are used in combination, and the latter two supplement and strengthen the first one to provide more context information; obtaining the output vector corresponding to the [CLS] symbol.
[0080] Figure 5 Shows the process of word vector extraction. In the figure, the final output T is the feature vector. C represents the output vector corresponding to the input [CLS]. The characters on the same line as the [CLS] token are the bytecodes after word segmentation, and these characters are processed to obtain the corresponding codes; for example, [CLS] corresponds to code 102.
[0081] 5. Webshell Detection Based on Sub - word Vectors
[0082] Since BERT uses sequence context data to generate word vectors, for webshell detection, which is a binary classification problem, XGBoost can be used as an excellent classification model.
[0083] In this embodiment, after passing the bytecode to BERT, after the output of the encoder layers of multiple transformers in the BERT model (including multi - head attention mechanism, feed - forward fully - connected layer, normalization layer), context information in which each sub - word is mapped to 768 dimensions (parameters can be adjusted) is formed. The classifier receives the output vector corresponding to the [CLS] symbol, and uses XGBoost as the classification model to determine whether there is an abnormality in the sub - word vector.
[0084] XGBoost is short for Extreme Gradient Boosting. XGBoost is a parallelization toolkit for boosting trees that focuses on speed, effectiveness, and portability. It improves the standard GBDT (Gradient Boosting Decision Tree) algorithm by using loss functions, regularization, and several other techniques, thus achieving an upgrade of the standard GBDT algorithm. XGBoost adds a new tree to fit the difference between the prediction result of the previous tree and the actual value, and builds a new model as the basis for subsequent model learning, thereby achieving excellent prediction accuracy.
[0085] Application Example:
[0086] There are normal samples as follows:
[0087] <?php
[0088] echo "Hello,World!";
[0089] $name = "User";
[0090] echo "Welcome,".$name;
[0091] ?>
[0092] After BERT encoding, the values of dimensions 100, 200, and 300 may be concentrated in a certain range (for example, from 0.2 to 0.5) because these codes are common and standard PHP syntax.
[0093] Abnormal samples are as follows:
[0094] <?php
[0095] eval($_POST['cmd']);
[0096] ? >
[0097] This code contains the eval function and the $_POST variable, which are typically used to execute arbitrary code and are typical features of a Webshell. After BERT encoding, the values of certain dimensions, such as dimensions 100, 200, and 300, may deviate significantly from the normal range (for example, the value of dimension 100 may be 0.8 and the value of dimension 200 may be -0.6) because the semantics and structure of these codes are quite different from normal samples.
[0098] Next, XGboost is used to train the classification model. The core idea of XGBoost is to combine multiple weak learners (usually decision trees) into a strong learner through ensemble learning to form a powerful prediction model. It gradually optimizes the model through the additive model and the forward stagewise algorithm. The additive model means that the final prediction result is the sum of the prediction results of multiple base learners; the forward stagewise algorithm is to add a new base learner in each iteration to fit the residual of the current model (the difference between the predicted value and the true value).
[0099] Normal samples in the output are labeled as 0, and abnormal samples are labeled as 1. The data is divided into a training set and a test set (70% for training and 30% for testing). The high-dimensional vectors output by BERT are standardized to eliminate the dimensional differences between features. Common standardization methods include Z-score standardization or Min-Max normalization. The standardized data can improve the training efficiency and classification performance of the XGBoost model.
[0100] The standardized high-dimensional vectors are input into the XGBoost model, and the model parameters are initially set. The main parameters include:
[0101] (1) objective: This parameter is used to specify the loss function and task type of the model, and the default setting is binary:logistic.
[0102] (2) eval_metric: This parameter is used to specify the metric for evaluating the model performance, and the default setting is logloss.
[0103] (3) num_class: This parameter is used to specify the number of classes in a multi-classification task, and the default setting is 2.
[0104] The initial training and testing are carried out with default parameters. 5-Fold Cross-Validation is adopted, and finally the average value is obtained to get the initial training and testing result scores. If the obtained test scores are not ideal or further optimization is desired, hyperparameter tuning needs to be carried out next. Since the xgboost model has a very large number of parameters compared to other models, how to optimize the parameters is a very challenging task.
[0105] In this embodiment, hyperparameter tuning is carried out under the sklearn framework, and the parameters that are relatively important in xgboost are selected as follows:
[0106] (1) n_estamitors: This parameter is used to specify how many decision trees are used in the model. The value range is [gbtree, gblinear], and the influence degree is 5.
[0107] (2) learning_rate: This parameter is used to control the weight of each tree. The value range is [0, 1], and the influence degree is 5.
[0108] (3) booster: This parameter is used to specify the base learner of the model. The influence degree is 5.
[0109] (4) colsample_bytree: The proportion of features used by each tree. The influence degree is 4.
[0110] (5) gama: It is used to control the minimum loss reduction threshold during the tree splitting process. The value range is [0, +∞], and the influence degree is 4.
[0111] (6) reg_lamada: This parameter is used to control the strength of L2 regularization (also known as Ridge regularization). The value range is [0, +∞], and the influence degree is 4.
[0112] (7) min_child_weight: This parameter is used to control the minimum value of the sample weights in the leaf nodes during the tree growth process. The influence degree is 4.
[0113] (8) max_depth: Controls the maximum depth of the decision tree to prevent overfitting. The influence degree is 2.
[0114] (9) reg_alpha: This parameter is used to control the strength of L1 regularization (also known as Lasso regularization). The influence degree is 2.
[0115] (10) subsample: The proportion of samples used by each tree. The influence degree is 2.
[0116] (11)scale_pos_weight: Controls the positive and negative sample ratio. The degree of influence is 2.
[0117] First, consider adjusting the parameters with a large and bounded degree of influence. Use the learning curve method for adjustment to find out the general distribution of the parameters and in which intervals better effects can be achieved. Next, use grid search to accurately locate the values and obtain the optimal values. For example, for the learning_rate parameter, select a suitable traversal function method according to the parameter type, define the range and step size, and draw a curve graph by calling the canvas function method. According to the trend of the curve graph approaching stability, the general interval of the value can be judged, and it can be determined that the value of learning_rate is 0.3.
[0118] For n_estamitors, when the range cannot determine the value, such as when 200, 400, and 5 all have good effects, it is necessary to further use the grid positioning method for further value positioning. After establishing the parameter space, calculate the size of the hyperparameter space. If the space result is very large, in the case of low computing resources and high efficiency requirements, it is necessary to mask some hyperparameters for further calculation of the hyperparameter space size until it is acceptable. Next, use random grid search to obtain the final hyperparameter values, fill the determined values back into the grid search again, unmask the masked hyperparameters, and gradually obtain the best values of all hyperparameters. Finally, perform cross-validation on the classification model to judge whether the test result score has improved.
[0119] The above technical solutions are only exemplary embodiments of the present invention. For those skilled in the art, based on the application methods and principles disclosed in the present invention, it is very easy to make various types of improvements or deformations, not limited to the methods described in the above specific embodiments of the present invention. Therefore, the above-described manner is only preferred and does not have a restrictive meaning.
Claims
1. An enhanced method for detecting Webshell based on the Bert model, comprising the following steps: S1. Extract bytecode from the script to be detected; S2. Using the obtained bytecode as a dataset, and utilizing the transformer encoder in the Bert model to generate multi-dimensional dynamic sub-word vectors based on context data; S3. For the generated sub-word vectors, use a grouping model to detect Webshell.
2. The method according to claim 1, wherein The specific steps of S1 include: S11. Perform lexical analysis on the Webshell script file; S12. Perform syntax analysis to generate an abstract syntax tree; S13. Read the abstract syntax tree and convert the operation nodes into corresponding bytecode.
3. The method according to claim 1, wherein In step S1, the Vulcan LogicDisassembler tool is used to extract bytecode from the PHP code of the Webshell script file.
4. The method according to claim 2, characterized in that, The specific steps of S2 include: S21. Tokenizer: Perform sub-word segmentation on the bytecode; S22. Embed the separator [CLS] in the BERT structure into the bytecode after sub-word segmentation; S23. Embeddings: Input the result of step S22 into the transformer encoder in the Bert model to obtain multi-dimensional sub-word vectors corresponding to the [CLS] symbol.
5. The method according to claim 4, characterized in that The specific method of step S21 includes: Traverse each word in the bytecode from the last letter forward, and determine whether the substring from the first letter to the current position is in the vocabulary during each traversal; If so, divide the current word into two sub-words from the traversed position, and repeat the previous steps for each sub-word; If the split sub-word is not the starting part of the non-split word, it is represented by the prefix "##" to assist in recombination during the decoding process.
6. The method according to claim 1, wherein In step S3, regarding Webshell detection as a binary classification problem, using XGBoost as a classification model to identify the situation where the values of certain dimensions in the generated sub-word vectors deviate from the normal range, thereby determining the existence of Webshell.
7. An enhanced system for detecting Webshell based on the Bert model by applying the method according to any one of claims 1-6, characterized in that, It includes: A bytecode extraction module for extracting bytecode from the script to be detected; A Bert encoding module for using the obtained bytecode as a dataset and utilizing the transformer encoder in the Bert model to generate multi-dimensional dynamic sub-word vectors based on context data; A Webshell detection module for using a grouping model to detect Webshell for the generated sub-word vectors.