A webshell detection method and system based on deep learning and dynamic behavior analysis

Abstract

This invention discloses a WebShell detection method and system based on deep learning and dynamic behavior analysis, relating to the field of network security technology. The method includes: preprocessing the backend management script code, extracting the corresponding bytecode, executing and recording the runtime behavior characteristics of the backend management script code in a sandbox environment, combining dynamic behavior characteristics with static bytecode characteristics to form a feature set; generating a first feature vector based on a deep learning model, introducing a graph neural network to generate a second feature vector; concatenating the first and second feature vectors to obtain an initial feature vector; using an autoencoder to perform dimensionality reduction and noise reduction on the initial feature vector to obtain an optimized feature vector; training the optimized feature vector using a deep forest model to generate a basic detection model, and optimizing the performance of the deep forest model. This invention improves the detection capability of obfuscated backend management scripts.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a WebShell detection method and system based on deep learning and dynamic behavior analysis. Background Technology

[0002] With the rapid development of the internet and the widespread use of web applications, numerous security challenges have emerged, among which webshell attacks are particularly prominent. A webshell is a command execution environment that exists in the form of web page files such as PHP, ASP, and JSP. Hackers often use it to infiltrate websites and gain long-term control of servers. These webshell files exist in the form of web page files such as ASP, PHP, and JSP. Attackers can access a backdoor file through a browser to obtain a command execution environment and remotely control the website server. To maintain long-term control of the server, attackers will highly conceal webshell files. Common concealment methods include information obfuscation, string concatenation, code encryption, and multiple encodings.

[0003] Traditional Webshell detection techniques primarily rely on feature matching, resulting in low detection rates. Currently, Webshell detection methods can be categorized into three types: file feature-based detection, traffic analysis-based detection, and Web log analysis-based detection. File feature-based detection methods mainly match the features of script files to complete the detection, relying on a large sample feature library, thus making it difficult to detect zero-day Webshells. Traffic analysis-based detection methods mainly detect Webshells by monitoring network traffic when they are executed. These methods are less effective at detecting highly concealed Webshells and have high maintenance costs, impacting server performance. Web log analysis-based detection methods mainly detect Webshells by analyzing relevant record information in Web logs. These methods are generally applied after the Webshell has been executed and can only be used as auxiliary tools.

[0004] With the development of deep learning and dynamic behavior analysis technologies, Webshell detection methods combining these emerging technologies have gradually become a research hotspot. For example, deep learning models can automatically extract complex feature combinations, while dynamic behavior analysis can monitor the behavioral characteristics of Webshells during runtime. Therefore, this invention proposes a Webshell detection system and method that integrates deep learning, dynamic behavior analysis, and multimodal feature extraction technologies, providing an efficient and robust Webshell detection solution suitable for security protection in various Web application environments.

[0005] No effective solutions have yet been proposed to address the problems in the relevant technologies. Summary of the Invention

[0006] In view of the problems in related technologies, this invention proposes a detection method and system based on deep learning and dynamic behavior analysis to overcome the aforementioned technical problems existing in the existing related technologies.

[0007] Therefore, the specific technical solution adopted by the present invention is as follows:

[0008] In a first aspect, the present invention provides a WebShell detection method based on deep learning and dynamic behavior analysis, the detection method comprising the following steps:

[0009] Data preprocessing is performed on the backend management script code to extract the bytecode corresponding to the backend management script code. The runtime behavior characteristics of the backend management script code are executed and recorded in a sandbox environment. The dynamic behavior characteristics are combined with the static bytecode characteristics to form a feature set.

[0010] The bytecode sequence is analyzed and understood based on a deep learning model to generate the first feature vector. At the same time, a graph neural network is introduced to model the control flow graph and data flow graph of the background management script code to generate the second feature vector.

[0011] The first and second feature vectors are concatenated to obtain the initial feature vector;

[0012] An autoencoder is used to reduce the dimensionality and denoise the initial feature vector to obtain an optimized feature vector.

[0013] The optimized feature vectors are trained using a deep forest model to generate a basic detection model. The pre-trained deep learning model is then transferred to the background management script detection task to further optimize the performance of the deep forest model.

[0014] Furthermore, data preprocessing is performed on the backend management script code, and the bytecode corresponding to the backend management script code is extracted, including:

[0015] We collected backend management script samples from various open-source platforms and real-world website environments, and selected samples that needed further verification through active learning methods for annotation and collection, extracting the backend management script code from the backend management script samples.

[0016] The backend management script code is converted into a bytecode sequence using a static code analysis tool.

[0017] Furthermore, by executing and recording the runtime behavior characteristics of the background management script code in a sandbox environment, and combining dynamic behavior characteristics with static bytecode characteristics, a feature set is formed, including:

[0018] Run background management script code in a sandbox environment and monitor its runtime behavior.

[0019] The monitored behavioral features are extracted into numerical vectors and then fused with the feature vectors of the bytecode extracted by the subsequent deep learning model.

[0020] Furthermore, monitoring its runtime behavior also includes:

[0021] System call frequency, network traffic characteristics, and file operation types.

[0022] Furthermore, based on the analysis and understanding of the bytecode sequence using a deep learning model, the first feature vector is generated, including:

[0023] The input sequence is encoded using an encoder from a deep learning model to obtain a sequence of hidden states.

[0024] The first hidden state in the hidden state sequence is obtained by pooling, thus yielding the first feature vector.

[0025] Furthermore, introducing graph neural networks to model the control flow graph and data flow graph of the background management script code to generate the second feature vector also includes:

[0026] Construct a flow graph and encode it using a graph neural network to obtain the embedding vector for each node;

[0027] The second feature vector of the flow graph is obtained by aggregating the embedding vector of each node.

[0028] Furthermore, a deep forest model is used to train the optimized initial feature vectors to generate a basic detection model, including:

[0029] The optimized initial feature vectors are used as input to train the deep forest model;

[0030] The deep forest model consists of multiple layers of decision trees, with the output of each layer serving as the input to the next layer.

[0031] Furthermore, transferring pre-trained deep learning models to background management script detection tasks includes:

[0032] The bytecode sequence is encoded using a pre-trained deep learning model to obtain a pre-trained feature vector;

[0033] The pre-trained feature vectors are combined with the optimized feature vectors and used as input to the deep forest model.

[0034] Furthermore, optimizing the performance of deep forest models also includes:

[0035] The deep forest model is trained using the cross-entropy loss function, and the optimized parameters θ of the deep forest model are:

[0036]

[0037] In the formula, θ represents the parameters of the optimized deep forest model; argmin represents the loss function; ζ represents the cross-entropy loss function; y represents the true label of the sample; f represents the prediction function of the deep forest model; h final This represents the optimized feature vector.

[0038] Secondly, the present invention also provides a WebShell detection system based on deep learning and dynamic behavior analysis, the detection system comprising:

[0039] The data preprocessing module is used to preprocess the backend management script code, extract the bytecode corresponding to the backend management script code, execute and record the runtime behavior characteristics of the backend management script code in a sandbox environment, and combine the dynamic behavior characteristics with the static bytecode characteristics to form a feature set.

[0040] The feature extraction module is used to analyze and understand bytecode sequences based on deep learning models to generate the first feature vector. At the same time, a graph neural network is introduced to model the control flow graph and data flow graph of the background management script code to generate the second feature vector.

[0041] The feature concatenation module is used to concatenate the first feature vector and the second feature vector to obtain the initial feature vector;

[0042] The dimension reduction and denoising module is used to perform dimension reduction and denoising on the initial feature vector using an autoencoder to obtain an optimized feature vector.

[0043] The model training module is used to train the optimized feature vectors using a deep forest model to generate a basic detection model, and then transfer the pre-trained deep learning model to the background management script detection task to further optimize the performance of the deep forest model.

[0044] The beneficial effects of this invention are as follows:

[0045] 1) Improve detection accuracy: By integrating static OPCODE features and dynamic behavioral features, combined with BERT's semantic analysis and GNN's structured modeling, the detection capability of obfuscated WebShells is significantly improved, and the false negative rate is reduced.

[0046] 2) Enhanced robustness: Dimensionality reduction and noise reduction processing of multimodal feature sets and autoencoders effectively cope with complex obfuscation techniques (such as code encryption and string concatenation), and improve the model's ability to generalize to unknown WebShells.

[0047] 3) Reduce computational complexity: Autoencoders optimize feature quality and reduce feature dimensionality; Deep Forest models are trained efficiently and are suitable for real-time detection in large-scale Web application environments.

[0048] 4) Enhance adaptability: Transfer learning methods utilize pre-trained models to enhance the model's ability to detect different types of WebShells, making it suitable for various Web application scenarios. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart of a WebShell detection method based on deep learning and dynamic behavior analysis according to an embodiment of the present invention;

[0051] Figure 2 This is a structural block diagram of a WebShell detection system based on deep learning and dynamic behavior analysis according to an embodiment of the present invention;

[0052] Figure 3 This is an architecture diagram of a WebShell detection model based on deep learning and dynamic behavior analysis according to an embodiment of the present invention. Detailed Implementation

[0053] To further illustrate the various embodiments, the present invention provides accompanying drawings, which are part of the disclosure of the present invention. These drawings are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these drawings, those skilled in the art should be able to understand other possible implementation methods and the advantages of the present invention. The components in the drawings are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0054] According to embodiments of the present invention, a WebShell detection method and system based on deep learning and dynamic behavior analysis are provided.

[0055] The present invention will now be further described in conjunction with the accompanying drawings and specific embodiments, such as... Figure 1 As shown, according to an embodiment of the present invention, a WebShell detection method based on deep learning and dynamic behavior analysis includes the following steps:

[0056] Step S1: Perform data preprocessing on the background management script code, extract the bytecode corresponding to the background management script code, execute and record the runtime behavior characteristics of the background management script code in a sandbox environment, and combine the dynamic behavior characteristics with the static bytecode characteristics to form a feature set.

[0057] It needs to be explained that the WebShell (i.e., the backend management script) code is preprocessed to extract the corresponding bytecode (OPCODE). A static code parsing tool (such as PHP's VLD extension) is used to convert the WebShell code into an OPCODE (bytecode) sequence. The WebShell code is then executed in a sandbox environment, recording its system calls, network connections, file operations, and other behaviors (i.e., dynamic behavioral characteristics). These dynamic behavioral characteristics are combined with the static OPCODE (bytecode) characteristics to form a comprehensive feature set.

[0058] Step S2: Analyze and understand the bytecode sequence based on the deep learning model to generate the first feature vector. At the same time, introduce a graph neural network to model the control flow graph and data flow graph of the background management script code to generate the second feature vector.

[0059] It should be explained that the BERT model (i.e., a deep learning model) is used to perform semantic analysis and contextual understanding on the OPCODE (i.e., bytecode) sequence to generate a high-dimensional feature vector (i.e., the first feature vector). The control flow graph (CFG) and data flow graph (DFG) of the WebShell code are modeled to extract structured features (i.e., the second feature vector).

[0060] Step S3: Concatenate the first feature vector and the second feature vector to obtain the initial feature vector;

[0061] It needs to be explained that the semantic features h generated by BERT (i.e., deep learning model) BERT (i.e., the first feature vector) and the structured features h generated by GNN GNN (i.e., the second eigenvector) are concatenated to obtain the initial eigenvector h. initial .

[0062] Step S4: Use an autoencoder to perform dimensionality reduction and noise reduction on the initial feature vector to obtain the optimized feature vector;

[0063] It needs to be explained that an autoencoder is used for h initial Dimensionality reduction and noise reduction are performed to obtain the optimized feature vector (i.e., the optimized feature vector) h. final :

[0064] h final =Decoder(Encoder(h initial)).

[0065] In the formula, h final This represents the optimized feature vector (a low-dimensional feature representation after dimensionality reduction and denoising by an autoencoder, retaining the main information of the input features and suitable for subsequent model training); h initial The initial feature vector (the semantic feature vector generated by BERT) is represented by the Decoder, which is the decoder part of the autoencoder (a neural network layer that reconstructs the low-dimensional latent representation into a high-dimensional output, generating the optimized feature vector); the encoder part of the autoencoder (a neural network layer that takes the high-dimensional input).

[0066] Step S5: Train the optimized feature vectors using a deep forest model to generate a basic detection model, and then transfer the pre-trained deep learning model to the background management script detection task to further optimize the performance of the deep forest model.

[0067] It's important to explain that a Deep Forest model is used to train the extracted features (i.e., the optimized initial features) to generate the basic detection model. The Deep Forest model learns and models features through a multi-layered forest structure, automatically extracting complex feature combinations and non-linear relationships. The pre-trained deep learning model is then transferred to the WebShell detection task to further optimize model performance.

[0068] In one embodiment, data preprocessing of the backend management script code and extraction of the corresponding bytecode includes the following steps:

[0069] Step S11: Collect backend management script samples based on major open source platforms and actual website environments, and select samples that need further verification through active learning methods for annotation and collection, and extract the backend management script code from the backend management script samples;

[0070] Step S12: Convert the background management script code into a bytecode sequence using a static code parsing tool.

[0071] It should be explained that WebShell samples and normal file samples were collected from major open-source platforms and real-world website environments (i.e., the entire Web ecosystem). Uncertain samples were selected for annotation and collection using an active learning method to ensure the authenticity and representativeness of the samples. The specific steps are as follows:

[0072] 1) Traverse the sample files and calculate the MD5 or SHA-256 hash value for each file. Use a programming language (such as os.walk in Python) to recursively traverse the directory, read the binary content of each file, and calculate the hash value through the MD5 or SHA-256 algorithm. MD5 outputs a 128-bit hash value (formula: A = B + ((A + F(B, C, D) + M[i] + T[j]) <<< s), where A, B, C, D are registers, F is a non-linear function, M[i] is the input sub-block, T[j] is a constant, <<< s is a left shift), and SHA-256 outputs a 256-bit hash value (formula: T1 = H7 + Σ1(E) + Ch(E, F, G) + K[t] + W[t], where H0 - H7 are registers, T1, T2 are temporary variables, Ch, Maj are logical functions, K[t], W[t] are constants and extended words). These algorithms are based on structures to ensure efficient and reliable deduplication and optimize the data preprocessing of the WebShell detection system.

[0073] 2) Store the hash values in a hash table for detecting duplicate files.

[0074] 3) If duplicate files are found, only keep one sample and delete the remaining duplicate samples.

[0075] 4) Execute commands on each PHP file to convert the PHP file into OPCODE. Use the VLD extension (VulcanLogic Dumper) of PHP or a similar static code parsing tool to read the PHP source code and compile it into a sequence of bytecodes executable by the Zend engine. The conversion process includes: loading the PHP file, parsing its abstract syntax tree (AST), generating an OPCODE sequence (representing low-level instructions of the code, such as variable assignment, function call) by the Zend compiler, and outputting it in text or binary format for subsequent analysis. OPCODE is the basic unit of PHP code execution, avoiding confusion interference and suitable for feature extraction in WebShell detection. The theoretical basis is the compilation mechanism of the Zend engine, which, based on lexical analysis and syntactic analysis, converts high-level code into machine-readable instructions. The formula is: AST → OPCODE = Zend_Compile(φ), where φ is the PHP source code and Zend_Compile is the compilation function, outputting the OPCODE sequence. The present invention uses OPCODE to capture the code semantics and enhance the detection robustness.

[0076] 5) Save the generated OPCODE output to a text file for subsequent processing.

[0077] In one embodiment, executing and recording the runtime behavior characteristics of background management script code in a sandbox environment, and combining dynamic behavior characteristics with static bytecode characteristics to form a feature set includes the following steps:

[0078] Step S13: Run the background management script code in the sandbox environment and monitor its runtime behavior.

[0079] Step S14: Extract the monitored behavioral features into numerical vectors and fuse them with the feature vectors of the bytecode extracted by the subsequent deep learning model.

[0080] In one embodiment, monitoring its runtime behavior characteristics further includes:

[0081] System call frequency, network traffic characteristics, and file operation types.

[0082] It should be explained that by executing WebShell code in a sandbox environment, its system calls, network connections, file operations, and other behaviors are recorded. These dynamic behavioral characteristics are combined with static OPCODE characteristics to form a comprehensive feature set. The specific steps are as follows:

[0083] 1) Run the WebShell code in a sandbox environment and monitor its runtime behavior, including but not limited to system call frequency, network traffic characteristics, and file operation types;

[0084] 2) Extract the monitored behavioral features into numerical vectors and fuse them with the feature vectors of the OPCODE extracted by the subsequent BERT model.

[0085] In one embodiment, analyzing and understanding a bytecode sequence based on a deep learning model to generate a first feature vector includes the following steps:

[0086] Step S21: Encode the input sequence using the encoder of the deep learning model to obtain the hidden state sequence;

[0087] Step S22: Take the first hidden state of the hidden state sequence through pooling operation to obtain the first feature vector.

[0088] It should be explained that the BERT model is used to perform semantic analysis and contextual understanding on the OPCODE sequence to generate a high-dimensional feature vector (i.e., the first feature vector). The specific steps are as follows:

[0089] 1) Input sequence X = (x1, x2, ..., x...) n ), where x i It is the i-th word in the OPCODE sequence.

[0090] 2) The input sequence is encoded using the encoder E of the BERT model to obtain the hidden state H = (h1, h2, ..., h...). n ), where h i ∈R d Let d be the hidden state of the i-th word, d be the dimension of the hidden layer, and R represent the set of real numbers. d Let be a d-dimensional real vector space, and let be the mathematical space representing the hidden states.

[0091] 3) Obtain the global feature vector h through pooling operations (such as taking the first hidden state of the sequence). BERT ∈R d :

[0092] h BERT =E(X)[0];

[0093] In the formula, h BERT The first feature vector represents the global feature vector; E represents the encoder of the BERT model, which consists of multiple Transformer layers and is responsible for mapping the input sequence to a high-dimensional hidden representation; X represents the input OPCODE sequence, in the form X = (x1, x2, ..., x...). n ), where each x i It is an OPCODE instruction in the sequence; [0] indicates that the first hidden state of the sequence is taken in the pooling operation, which is used to represent the h of the entire sequence. BERT (Global feature vector)

[0094] In one embodiment, introducing a graph neural network to model the control flow graph and data flow graph of the background management script code to generate the second feature vector further includes the following steps:

[0095] Step S23: Construct a flow graph and encode it using a graph neural network to obtain the embedding vector for each node;

[0096] Step S24: Obtain the second feature vector of the flow graph by aggregating the embedding vector of each node.

[0097] It needs to be explained that the control flow graph (CFG) and data flow graph (DFG) of the WebShell code are modeled to extract structured features (i.e., the second feature vector). The specific steps are as follows:

[0098] 1) Construct a graph G = (V, E), where V is a set of nodes (representing variables or operations in the code) and E is a set of edges (representing dependencies between variables or control flow).

[0099] 2) Encode the graph G using a graph neural network (such as GCN or GAT) to obtain the embedding vector for each node.

[0100] 3) Obtain the global feature vector h of the graph through aggregation operations. GNN ∈R d :

[0101]

[0102] In the formula, h GNN The first vector represents the global feature vector (i.e., the second feature vector), which represents the structured features of the entire control flow graph (CFG) and data flow graph (DFG), used for feature fusion in WebShell detection; the second vector represents the aggregation function, which can be mean pooling, max pooling, or summation, and is responsible for aggregating the embedding vectors of all nodes into a single global vector; the third vector is the set of nodes (containing all nodes in graph G, traversed from the first node to the last, each node representing a variable or operation in the code); the fourth vector represents the number of nodes.

[0103] The fused feature vectors are then subjected to dimensionality reduction and noise reduction. The specific steps are as follows:

[0104] 1) The semantic features h generated by BERT BERT and the structured features h generated by GNN GNN By concatenating the vectors, we obtain the initial feature vector h. initial .

[0105] 2) Use an autoencoder for h initial Dimensionality reduction and noise reduction are performed to obtain the optimized feature vector h. final :

[0106] h final =Decoder(Encoder(h initial )).

[0107] In one embodiment, training the optimized feature vectors using a deep forest model to generate a basic detection model includes the following steps:

[0108] Step S51: Use the optimized feature vector as input to train the deep forest model;

[0109] Step S52: The deep forest model consists of multiple decision trees, with the output of each decision tree serving as the input to the next layer.

[0110] It needs to be explained that a Deep Forest model is used to train the extracted features to generate a basic detection model. The Deep Forest model learns and models features through a multi-layered forest structure, automatically extracting complex feature combinations and non-linear relationships. The specific steps are as follows: The optimized feature vector h... finalThe deep forest model is trained using the input. A deep forest model consists of multiple layers of decision trees, with the output of each layer serving as the input to the next layer.

[0111] In one embodiment, transferring a pre-trained deep learning model to a background management script detection task includes the following steps:

[0112] Step S53: Encode the bytecode sequence using a pre-trained deep learning model to obtain a pre-trained feature vector;

[0113] Step S54: Combine the pre-trained feature vectors with the optimized feature vectors and use them as input to the deep forest model.

[0114] It should be explained that the pre-trained deep learning model is transferred to the WebShell detection task to further optimize model performance. The specific steps are as follows:

[0115] 1) Encode the OPCODE sequence using a pre-trained BERT model to obtain the pre-trained feature vector h. pretrain .

[0116] 2) h pretrain With the optimized feature vector h final Combined, it serves as input for the deep forest model.

[0117] 3) Fine-tune the deep forest model and optimize the deep forest model parameters θ.

[0118] In one embodiment, optimizing the performance of a deep forest model further includes the following steps:

[0119] The deep forest model is trained using the cross-entropy loss function, and the optimized parameters θ of the deep forest model are:

[0120]

[0121] In the formula, θ represents the optimized parameters of the deep forest model, and the optimized parameter values ​​are used to generate the final WebShell detection model; argmin represents the parameters that minimize the objective function (here, the loss function); ζ represents the cross-entropy loss function, which measures the difference between the model's prediction and the true label; y represents the true label of the sample (e.g., 1 for WebShell, 0 for normal file); f represents the prediction function of the deep forest model, with the optimized feature vector; h final This represents the optimized feature vector, which is generated by the autoencoder from the initial feature vector.

[0122] According to another embodiment of the present invention, the present invention also provides a WebShell detection system based on deep learning and dynamic behavior analysis, the detection system comprising:

[0123] The data preprocessing module 201 is used to preprocess the background management script code, extract the bytecode corresponding to the background management script code, execute and record the runtime behavior characteristics of the background management script code in a sandbox environment, and combine the dynamic behavior characteristics with the static bytecode characteristics to form a feature set.

[0124] The feature extraction module 202 is used to analyze and understand the bytecode sequence based on the deep learning model to generate the first feature vector. At the same time, it introduces a graph neural network to model the control flow graph and data flow graph of the background management script code to generate the second feature vector.

[0125] The feature concatenation module 203 is used to concatenate the first feature vector and the second feature vector to obtain the initial feature vector;

[0126] The dimension reduction and denoising module 204 is used to perform dimension reduction and denoising on the initial feature vector using an autoencoder to obtain an optimized feature vector.

[0127] The model training module 205 is used to train the optimized feature vectors using a deep forest model to generate a basic detection model, and to transfer the pre-trained deep learning model to the background management script detection task to further optimize the performance of the deep forest model.

[0128] To facilitate understanding of the above technical solutions of the present invention, the working principle or operation method of the present invention in actual process will be described in detail below.

[0129] It needs to be explained that 1) Multimodal feature fusion: combines static OPCODE features and dynamic behavioral features (such as system calls, network connections, and file operations) to form a comprehensive feature set.

[0130] 2) Combining deep learning with GNN: Using the BERT model for semantic analysis of OPCODE sequences, and combining GNN for structured modeling of CFG and DFG, extracting high-dimensional semantic features and structured features.

[0131] 3) Autoencoder optimization: The feature vector is reduced in dimensionality and denoised by an autoencoder, thereby improving feature quality and reducing computational complexity.

[0132] 4) Deep Forest and Transfer Learning: A high-efficiency detection model is trained using a deep forest model, and the model performance is optimized and generalization ability is enhanced through transfer learning.

[0133] 5) Dynamic analysis of sandbox environment: Execute WebShell code in the sandbox environment, extract runtime behavior features, and fuse them with static features.

[0134] In summary, by utilizing the above-mentioned technical solutions of this invention, a WebShell detection method integrating deep learning, dynamic behavior analysis, and multimodal feature extraction is proposed, aiming to significantly improve the accuracy and robustness of detection. Specifically, this invention first preprocesses the WebShell code to extract the corresponding bytecode (OPCODE), and combines it with a dynamic behavior analysis module to record the runtime behavior features of the WebShell code in a sandbox environment, combining static OPCODE features with dynamic behavior features to form a comprehensive feature set. In the feature extraction stage, this invention uses a deep learning model (BERT) to perform semantic analysis and contextual understanding on the OPCODE sequence, generating high-dimensional feature vectors; simultaneously, a graph neural network (GNN) is introduced to model the control flow graph (CFG) and data flow graph (DFG) of the WebShell code to extract structured features; further, an autoencoder is used to perform dimensionality reduction and noise reduction on the feature vectors to optimize feature quality. During the model training phase, a Deep Forest model is used to train the extracted features, generating a basic detection model. Transfer learning is then employed to transfer the pre-trained deep learning model to the WebShell detection task, further optimizing model performance. This invention effectively addresses the complex obfuscation techniques of WebShell code, providing an efficient and reliable solution for WebShell detection and significantly enhancing web security protection capabilities.

[0135] In this invention, unless otherwise explicitly specified and limited, the terms "installation," "setting," "connection," "fixing," "screw connection," etc., should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal connection of two components or the interaction between two components. Unless otherwise explicitly limited, those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0136] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A WebShell detection method based on deep learning and dynamic behavior analysis, characterized in that, include: S1. Perform data preprocessing on the backend management script code, extract the bytecode corresponding to the backend management script code, execute and record the runtime behavior characteristics of the backend management script code in a sandbox environment, and combine the dynamic behavior characteristics with the static bytecode characteristics to form a feature set; including: S11. Collect backend management script samples based on major open source platforms and actual website environments, and select samples that need further verification through active learning methods for annotation and collection, and extract the backend management script code from the backend management script samples. S12. Convert the backend management script code into a bytecode sequence using a static code parsing tool; S13. Run the background management script code in the sandbox environment and monitor its runtime behavior. S14. Extract the monitored behavioral features into numerical vectors and fuse them with the feature vectors of the bytecode extracted by the subsequent deep learning model; S2. Analyze and understand the bytecode sequence based on the deep learning model to generate the first feature vector, and at the same time introduce graph neural networks to model the control flow graph and data flow graph of the background management script code to generate the second feature vector. S3. Concatenate the first feature vector and the second feature vector to obtain the initial feature vector; S4. Use an autoencoder to perform dimensionality reduction and noise reduction on the initial feature vector to obtain the optimized feature vector; including: Use an autoencoder for h initial Dimensionality reduction and noise reduction are performed to obtain the optimized feature vector h. final : ； In the formula, h final This represents the optimized feature vector, a low-dimensional feature representation after dimensionality reduction and denoising by an autoencoder. It retains the main information of the input features and is suitable for subsequent model training; h initial Represents the initial feature vector; Decoder represents the decoder part of the autoencoder; Encoder represents the encoder part of the autoencoder; S5. A deep forest model is used to train the optimized feature vectors, generating a basic detection model. The pre-trained deep learning model is then transferred to the background management script detection task to further optimize the deep forest model's performance; this includes: S51. Use the optimized feature vectors as input to train the deep forest model; S52. The deep forest model consists of multiple decision trees, with the output of each decision tree serving as the input to the next layer. S53. Encode the bytecode sequence using a pre-trained deep learning model to obtain a pre-trained feature vector; S54. Combine the pre-trained feature vectors with the optimized feature vectors and use them as input to the deep forest model.

2. The WebShell detection method based on deep learning and dynamic behavior analysis according to claim 1, characterized in that, The monitoring of its runtime behavior characteristics also includes: System call frequency, network traffic characteristics, and file operation types.

3. The WebShell detection method based on deep learning and dynamic behavior analysis according to claim 1, characterized in that, The process of analyzing and understanding bytecode sequences based on a deep learning model to generate the first feature vector includes: S21. Encode the input sequence using the encoder of the deep learning model to obtain the hidden state sequence; S22. The first hidden state of the hidden state sequence is obtained by pooling, thus obtaining the first feature vector.

4. The WebShell detection method based on deep learning and dynamic behavior analysis according to claim 1, characterized in that, The method of introducing a graph neural network to model the control flow graph and data flow graph of the background management script code to generate the second feature vector also includes: S23. Construct a flow graph and encode it using a graph neural network to obtain the embedding vector for each node; S24. The second feature vector of the flow graph is obtained by aggregating the embedding vector of each node.

5. The WebShell detection method based on deep learning and dynamic behavior analysis according to claim 1, characterized in that, The optimization of deep forest model performance also includes: The deep forest model is trained using the cross-entropy loss function to optimize its parameters. for: ； In the formula, This represents optimizing the parameters of the deep forest model; argmin represents solving for the loss function. Let represent the cross-entropy loss function; y represent the true label of the sample; f represent the prediction function of the deep forest model; h final This represents the optimized feature vector.

6. A WebShell detection system based on deep learning and dynamic behavior analysis, used to implement the WebShell detection method according to any one of claims 1-5, characterized in that, include: The data preprocessing module is used to preprocess the backend management script code, extract the bytecode corresponding to the backend management script code, execute and record the runtime behavior characteristics of the backend management script code in a sandbox environment, and combine the dynamic behavior characteristics with the static bytecode characteristics to form a feature set. The feature extraction module is used to analyze and understand bytecode sequences based on deep learning models to generate the first feature vector. At the same time, a graph neural network is introduced to model the control flow graph and data flow graph of the background management script code to generate the second feature vector. The feature concatenation module is used to concatenate the first feature vector and the second feature vector to obtain the initial feature vector; The dimension reduction and denoising module is used to perform dimension reduction and denoising on the initial feature vector using an autoencoder to obtain an optimized feature vector. The model training module is used to train the optimized feature vectors using a deep forest model to generate a basic detection model, and then transfer the pre-trained deep learning model to the background management script detection task to further optimize the performance of the deep forest model.

Images