Webshell malicious behavior fine-grained method based on abstract syntax tree and de-obfuscation

Abstract

This invention discloses a fine-grained method for detecting WebShell malicious behavior based on abstract syntax trees and deobfuscation. The method includes: inputting a suspicious WebShell script file into a computer system; rapidly identifying and normalizing the suspicious script through file format screening, feature matching, and file standardization to obtain a normalized script; performing deobfuscation on the normalized script based on a large language model to obtain simplified semantically equivalent code; parsing the code to generate an abstract syntax tree; extracting key features through a multi-granularity feature extraction mechanism while capturing multi-dimensional contextual dependencies; vectorizing the extracted multi-dimensional features and performing feature fusion; inputting the vectorized features into a deep neural network combining ResNet, BiLSTM, and Transformer; and outputting WebShell malicious behavior detection results and fine-grained classification results. This invention solves the problems of low detection accuracy and high false positive / false negative rates in existing detection methods when facing highly concealed, modified, and obfuscated WebShell attacks.

Description

Technical Field

[0001] This invention relates to the technical fields of natural language processing, network security, and computer security, and specifically to a fine-grained method for detecting malicious WebShell behavior based on abstract syntax trees and deobfuscation. Background Technology

[0002] WebShell, as a highly concealed malicious tool, is often used by attackers to infiltrate corporate servers by implanting malicious web script files such as PHP and ASP. After gaining remote control privileges, attackers can execute remote commands, steal core data, damage system functions, and even expand the attack range by moving laterally, posing a huge threat to the system security of enterprises and individuals.

[0003] Traditional WebShell detection methods typically rely on signature matching, identifying malicious scripts by comparing them to preset signatures in files. While this approach has some practical use in detecting known samples, it has significant limitations. First, WebShell signatures are often encrypted, obfuscated, or transformed, making traditional signature-based detection methods ineffective. Furthermore, attackers can bypass detection by disguising themselves and changing script content, resulting in extremely low accuracy in identifying new types of WebShells. Second, they lack adaptability; signature databases require substantial human and material resources to update and maintain, making them unable to adapt to rapidly changing attack methods.

[0004] To address the aforementioned limitations, researchers proposed a behavior-based WebShell detection method. This method assesses malicious intent by monitoring dynamic behaviors such as system resource access, file operations, and network connections during script execution in real time, and can identify some unknown WebShells. However, inherent drawbacks remain: first, high system overhead; second, high false positive rate, as the behavioral characteristics of some normal scripts can be easily confused with malicious behavior. Meanwhile, with the development of deep learning technology, deep learning-based WebShell detection methods have been widely applied. By automatically learning the characteristics and behavioral patterns of WebShells, detection accuracy has improved when dealing with obfuscated and polymorphic attacks. However, inherent shortcomings still exist. First, effective feature extraction is difficult, making it hard to cope with the high degree of concealment of WebShells. Second, the false positive and false negative rates are high in complex scenarios, lacking in-depth analysis of multi-dimensional malicious behavior.

[0005] In summary, existing WebShell detection methods still suffer from problems such as ineffective handling of obfuscated and disguised malicious code, lack of comprehensive analysis of complex WebShell behavior, and high false positive and false negative rates. There is an urgent need for a more efficient and accurate WebShell detection method that combines advanced technologies such as deep learning and behavioral analysis to improve the defense against WebShell attacks. Summary of the Invention

[0006] The main objective of this invention is to provide a fine-grained method for detecting malicious WebShell behavior based on abstract syntax trees and deobfuscation. This addresses the problems in existing technologies, such as the inability to effectively handle modified and obfuscated malicious code, the lack of comprehensive analysis of complex WebShell behavior, and high false positive and false negative rates. This invention, through deobfuscation processing combined with deep learning and behavioral analysis techniques, can deeply mine the dynamic behavioral characteristics of WebShells, improve the ability to identify complex attacks, and ensure accurate detection and defense against WebShells.

[0007] Based on a first major aspect of the invention, a fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation is provided, comprising a computer performing the following steps:

[0008] Input suspicious WebShell script files into the computer system, and quickly identify and standardize the suspicious scripts through file format screening, feature matching, and file standardization to obtain standardized scripts;

[0009] The normalized script is deobfuscated based on a large language model to obtain simplified and semantically equivalent code.

[0010] The code is parsed to generate an abstract syntax tree. Dangerous function call detection, expression and variable flow analysis, control flow depth statistics, and concatenation operator frequency analysis are extracted through a multi-granularity feature extraction mechanism, while capturing multi-dimensional context dependencies.

[0011] After extracting multidimensional features and vectorizing them, feature fusion is performed, and the input is a deep neural network combining ResNet, BiLSTM and Transformer;

[0012] The computer system processor executes computer programs and outputs WebShell malicious behavior detection results and fine-grained classification results of malicious behavior.

[0013] As a further preferred embodiment, in the aforementioned method, the file format screening checks the extension and header signature of the suspected WebShell script files, retaining script files belonging to the Web script type;

[0014] The feature matching includes using multi-granular keyword statistics, regular expression pattern detection, and function sequence pattern comparison on the script files belonging to the Web script type to quickly identify potential WebShell features and judge the scripts;

[0015] The document standardization process specifically involves standardizing the format of scripts deemed suspicious or malicious. This standardization process includes removing blank lines, removing comments, unifying character encoding and indentation style, and finally outputting the standardized script.

[0016] As a further preferred embodiment, in the aforementioned method, the regular pattern detection includes:

[0017] A global scan is performed on script files that belong to the Web script type, and the frequency of high-risk functions is counted. If the frequency exceeds a set threshold, the function is marked as suspicious.

[0018] Use regular expressions to match decoding chains and dynamic execution patterns to capture suspicious behaviors such as multi-layer decoding or dynamic parameter injection.

[0019] Construct a function call chain and compare it with known WebShell behavior sequences. Use the LCS algorithm to calculate the similarity and determine whether the script file belonging to the Web script type has WebShell characteristics.

[0020] As a further preferred embodiment, in the aforementioned method, the de-obfuscation operation includes the following six steps:

[0021] Preprocessing operations are performed on the obfuscated code in the normalized script;

[0022] The code after preprocessing is divided into different functional modules according to its function;

[0023] Design specific prompt templates to guide the large language model to gradually decrypt the code and restore dynamic function calls;

[0024] The code is standardized according to pre-defined security standards;

[0025] The correctness of the standardized code is verified by performing the operation on the large language model.

[0026] Perform the deobfuscation operation on the verified code to generate the simplified, semantically equivalent code.

[0027] As a further preferred embodiment, in the aforementioned method, the step of parsing the code to generate an abstract syntax tree specifically means using a corresponding parser to generate a consistent abstract syntax tree representation for different scripting languages;

[0028] The multi-granularity feature extraction mechanism simultaneously analyzes control flow and data dependency features, enhancing the complete capture of the multi-dimensional context dependencies;

[0029] The multidimensional features include Word features, Token features, AST features, and Flow features.

[0030] As a further preferred embodiment, in the aforementioned method, the extraction of Word features includes: extracting lexical-level semantic features of the WebShell script through code semantic normalization technology, and after full-width to half-width conversion and keyword case uniform cleaning, extracting high-frequency semantic words related to attacks, as well as string features related to the file system and command execution;

[0031] Then, the WordShellVec mechanism is used to construct an adjacency matrix based on word context co-occurrence relationships, and to learn dense word vectors using the Skip-Gram architecture to capture semantic associations of attack words.

[0032] As a further preferred embodiment, in the aforementioned method, the extraction of the token features includes: lexical tokenization of the WebShell script to obtain a token sequence;

[0033] A marker co-occurrence graph is constructed by analyzing frequency and contextual distribution;

[0034] The WordShellVec embedding model is used to generate dense vectors for each token, and the final vector sequence is concatenated using the WebShell lexical semantic vector generation formula.

[0035] The formula for generating WebShell semantic vectors is as follows:

[0036]

[0037] in, The final semantic vector representation of the token features is given by TokenShellVec(·), where TokenShellVec(·) represents the vector generation function for the token features, and T represents the input token sequence. This represents the semantic vector of a tag, where n represents the total number of basic syntactic units in the tag sequence obtained after the WebShell script has been lexically tokenized.

[0038] As a further preferred embodiment, in the aforementioned method, the extraction of AST features includes: converting different script files into ASTs using corresponding parsers, performing semantic transformation by traversing nodes level by level, constructing a path set using the AST feature vector generation formula, and vectorizing it.

[0039] The extraction of the flow features includes: constructing a global execution flow view by combining the control flow graph and the data flow graph, and extracting global dependency features through a graph convolutional network;

[0040] As a further preferred embodiment, in the aforementioned method, the feature fusion includes the following steps:

[0041] The vectorized multidimensional features are padded to unify the vector length, and a fusion function is used to map the padded multidimensional features to a shared feature space to obtain high-order comprehensive features, thus completing the feature fusion.

[0042] The fusion function is:

[0043]

[0044] in, Represents higher-order synthetic features, divide and sum These represent the features corresponding to TokenShell, ASTShell, WordShell, and FlowShell, respectively. This indicates aligning different features into a common space.

[0045] Based on a second key aspect of the invention, the invention provides a computer-readable storage medium having a computer program stored thereon that, when executed, implements the fine-grained method for WebShell malicious behavior based on an abstract syntax tree and deobfuscation as described above.

[0046] Compared with existing technologies, this invention provides a fine-grained method for detecting WebShell malicious behavior based on abstract syntax trees and deobfuscation. First, addressing the shortcomings of existing methods in effectively handling modified and obfuscated malicious code, this invention introduces Large Language Models (LLMs) to perform deobfuscation operations, directly processing the original source code, restoring the encoding semantics, and generating simplified, semantically equivalent code. This breaks through multi-layered obfuscation and encoding evasion techniques, improves detection interpretability, and lays a high-quality data foundation for subsequent accurate analysis.

[0047] Secondly, addressing the lack of comprehensive analysis of complex WebShell behavior in existing methods, this invention, based on the deobfuscation results, converts script files of different formats into ASTs using corresponding parsers. With the help of a multi-granularity extraction mechanism, it analyzes dangerous function calls, variable flow, control flow complexity, etc., capturing multi-dimensional context dependencies. This overcomes the shortcomings of traditional methods that rely only on surface features and lack sufficient analysis depth, thus improving the accuracy and depth of WebShell detection.

[0048] Finally, this invention constructs a hybrid detection model by integrating deep neural networks such as ResNet, BiLSTM, and Transformer, which extracts feature space correlation, temporal dependency, and global interaction information respectively, thereby improving the accuracy of WebShell malicious behavior detection and the precision of fine-grained classification, and effectively reducing the false positive and false negative rates. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0050] Figure 1 The following is an execution flowchart of a fine-grained method for detecting WebShell malicious behavior based on an abstract syntax tree and deobfuscation, according to an embodiment of the present invention.

[0051] Figure 2 This illustrates the implementation flow of the WebShell code extraction and deobfuscation steps and the parsing into an abstract syntax tree step in a fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation, according to an embodiment of the present invention.

[0052] Figure 3 This illustrates the implementation flow of Webshell feature extraction and multi-view fusion steps in a fine-grained method for Webshell malicious behavior based on abstract syntax trees and deobfuscation, as described in one embodiment of the present invention.

[0053] Figure 4 This illustration shows the model building steps and malicious behavior detection and fine-grained classification in a fine-grained method for Webshell malicious behavior based on abstract syntax tree and deobfuscation in one embodiment of the present invention;

[0054] Figure 5 This illustrates an execution example of WebShell code extraction in one embodiment of the present invention;

[0055] Figure 6 This illustrates an example of a WebShell abstract syntax tree generation and simulated execution architecture in one embodiment of the present invention. Detailed Implementation

[0056] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the present invention. It should be understood that the following embodiments are not intended to limit the scope of the present invention, but are merely illustrative of the essential spirit of the technical solution of the present invention.

[0057] In the following description, certain specific details are set forth for the purpose of illustrating various disclosed embodiments in order to provide a thorough understanding of the various disclosed embodiments. However, those skilled in the art will recognize that embodiments may be practiced without one or more of these specific details. In other instances, well-known techniques associated with the invention may not have been shown or described in detail to avoid unnecessarily obscuring the description of the embodiments.

[0058] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0059] The specific meanings of the technical terms or English abbreviations that may be involved in this invention are explained below.

[0060] WebShell: Refers to a malicious script executed through a web server, used to illegally control the server, steal data, etc.

[0061] ResNet: Residual Network, a deep convolutional neural network that introduces residual connections. Its core design uses skip connections across layers to allow the network to directly learn the residual mapping between input and output.

[0062] BiLSTM: Bidirectional Long Short-Term Memory Network, is a recurrent network variant based on the Long Short-Term Memory Network. Its core design involves the parallel deployment of a forward Long Short-Term Memory Network and a backward Long Short-Term Memory Network. The forward Long Short-Term Memory Network captures historical temporal dependencies sequentially, while the backward Long Short-Term Memory Network captures future temporal dependencies in reverse order.

[0063] Transformer: A deep learning model based on self-attention mechanism. Its core design includes modules such as multi-head self-attention mechanism, position encoding, and feedforward neural network. It does not rely on recurrent or convolutional structures. Through self-attention mechanism, it can compute the association weights of all positions in the sequence in parallel, efficiently capture long-distance and cross-position global dependencies, and retain the sequence order information through position encoding, thus possessing powerful global semantic modeling capabilities.

[0064] AST: Abstract Syntax Tree, refers to the tree-like structure of syntax nodes, structural relationships, and semantic relationships formed after parsing script code.

[0065] LCS algorithm: Longest Common Subsequence algorithm, a dynamic programming algorithm for finding the longest common subsequence between two sequences. Its core function is to find the longest common subsequence between two input sequences without requiring the elements to be consecutive but maintaining their original order, and output the length of the subsequence or the specific combination of elements.

[0066] Skip-Gram architecture: The core principle of the skip-word model is to predict the context words of the target word. The one-hot vector of a single target word is input and mapped into a low-dimensional dense word vector through a single or multi-layer neural network. Then, the output layer predicts all the context words of the target word within a specified window size.

[0067] like Figure 1 As shown, in one embodiment of the present invention, a fine-grained method for detecting malicious WebShell behavior based on abstract syntax trees and deobfuscation is provided, including the following steps 100-S500 performed by a computer:

[0068] 100. Input suspicious WebShell script files into the computer system. Quickly identify and standardize the suspicious scripts through file format screening, feature matching, and file standardization to obtain standardized scripts;

[0069] 200. Based on the large language model, perform a deobfuscation operation on the normalized script to obtain simplified and semantically equivalent code;

[0070] 300, the code is parsed to generate an abstract syntax tree, and dangerous function call detection, expression and variable flow analysis, control flow depth statistics and concatenation operator frequency analysis are extracted through a multi-granularity feature extraction mechanism, while capturing multi-dimensional context dependencies;

[0071] 400, after extracting multidimensional features and vectorizing them, feature fusion is performed, and the input is a deep neural network combining ResNet, BiLSTM and Transformer;

[0072] 500, the computer system processor executes a computer program, outputting WebShell malicious behavior detection results and fine-grained classification results of malicious behavior.

[0073] Among the following possible implementations, combining Figure 2-4 As shown below, the methods and steps provided above will be explained in detail.

[0074] In one feasible embodiment, step 100 is first described:

[0075] Combination Figure 2 and Figure 5As shown, in the WebShell code extraction stage, the input script files are first screened for file format (File Format Checking) as a preliminary screening. By checking the file extension and file header signature, only common Web script types, such as .php, .asp, .jsp, etc., are retained.

[0076] This stage effectively eliminates non-script files and disguised binary or compressed files, reducing the computational overhead of subsequent analysis.

[0077] Then, feature-based pattern matching (Keyword & Pattern-based Matching) is performed on the filtered script files. Multi-granularity keyword statistics, regular expression pattern detection, and function sequence pattern comparison are used to quickly identify potential WebShell features.

[0078] This detection includes: a global scan script that counts the frequency of high-risk functions (such as eval, exec, etc.), and marks them as suspicious if the frequency exceeds a set threshold.

[0079] Use regular expressions to match decoding chains and dynamic execution patterns to capture suspicious behaviors such as multi-layer decoding or dynamic parameter injection.

[0080] Construct a function call chain and compare it with known WebShell behavior sequences. Use the LCS algorithm to calculate the similarity and determine whether the script has WebShell characteristics.

[0081] Finally, scripts deemed suspicious or malicious undergo file normalization and feature extraction (Normalization & Cleaning). This involves removing blank lines, stripping comments, standardizing character encoding and indentation style, and outputting standardized scripts for subsequent static analysis and dynamic behavior detection.

[0082] Step 200 is described in the following possible implementations.

[0083] During the deobfuscation phase of WebShell code, WebShell scripts are typically heavily obfuscated using techniques such as nested functions, encoded strings, and dynamic variable concatenation to circumvent static feature matching and traditional detection methods. Traditional deobfuscation methods, such as syntax-based decoding and sandbox dynamic triggering, have limited effectiveness when dealing with complex cross-function / file obfuscation.

[0084] To address these issues, this invention introduces large-scale language models (LLMs), such as GPT-4 and DeepSeek, which possess powerful contextual reasoning and cross-layer semantic recovery capabilities. By directly processing the original source code, these models can recover the encoded semantics (such as base64, gzinflate, and eval) through multi-layer reasoning, generating simplified and semantically equivalent code, thus improving the accuracy and interpretability of detection.

[0085] The deobfuscation process includes six key steps:

[0086] First, the obfuscated code is preprocessed to prepare for subsequent analysis.

[0087] Next, the code was divided into multiple functional modules (such as input / output, validation, command execution, etc.) for easy independent analysis.

[0088] Then, a specific prompt template is designed to guide the model to decrypt the code step by step and restore the dynamic function calls; next, the code is standardized according to security requirements to ensure that it meets the predetermined standards.

[0089] During the simulation execution phase, the model verifies the correctness of the code through simulated execution.

[0090] Finally, the code was deobfuscated to restore it to a simplified, semantically clear version, laying the foundation for subsequent feature extraction and detection.

[0091] This six-step deobfuscation method significantly improves the accuracy and interpretability of WebShell detection and can effectively deal with complex obfuscation and encoding strategies.

[0092] Step 300 is described in the following possible implementations.

[0093] Combination Figure 2 and Figure 6 As shown, after completing multi-stage pre-screening, feature detection, normalization processing and large model deobfuscation, this invention designs and implements a deep static structure analysis process based on abstract syntax tree (AST) to comprehensively describe the control flow and data dependency characteristics of WebShell scripts.

[0094] Unlike traditional line-by-line detection methods, the AST module transforms the source code into a hierarchical, dependency-aware semantic tree, providing a fine-grained structural foundation for identifying potential malicious behavior.

[0095] For different scripting languages, such as PHP, JSP, and ASP, this invention uses corresponding parsers, such as Php Parser, JavaParser, and JScriptParser, to generate a consistent AST representation, providing support for subsequent analysis.

[0096] The AST analysis module employs a multi-granularity structural feature extraction mechanism, traversing AST nodes layer by layer and extracting key features, including dangerous function call detection, expression and variable flow analysis, control flow depth statistics, and concatenation operator frequency analysis.

[0097] The system also calculates global structural metrics, such as maximum nesting depth and frequency of sensitive API calls. These features not only provide a syntactic framework for the script but also capture multidimensional contextual dependencies, laying the foundation for subsequent deep learning modeling.

[0098] Through this AST analysis module, WebShell detection is elevated from text matching to deep syntax and contextual understanding, laying a solid foundation for structure-aware detection and semantic modeling.

[0099] Step 400 is described in the following possible implementations.

[0100] In the feature extraction stage, based on the parsed AST and deobfuscated code, multi-dimensional features such as word, token, flow, and AST are extracted, including function call CHA, jump paths in the control flow graph, data dependencies, the ratio of suspicious inputs to dangerous functions, and key commands extracted from the deobfuscated code.

[0101] These static features help capture potential malicious intent in scripts and serve as basic metrics for detection models.

[0102] The extraction of Word features is illustrated in the following feasible embodiment:

[0103] This invention extracts lexical-level semantic features of WebShell scripts through code semantic normalization technology. After cleaning such as full-width to half-width conversion and keyword case unification, it extracts high-frequency semantic words related to attacks, as well as string features related to file system and command execution.

[0104] Among them, high-frequency semantic words include system function calls, such as eval, dangerous built-in function combinations, such as base64_decode, and user-defined functions and variables.

[0105] Command execution-related string characteristics include path expressions, shell command fragments, web control entry points, and sensitive behavior identifiers.

[0106] Meanwhile, the WordShellVec embedding mechanism designed in this invention specifically includes:

[0107] Based on word context co-occurrence relationships, an adjacency matrix is ​​constructed using a sliding window, and a Skip-Gram architecture is employed to learn dense vector representations of terms. This mechanism can capture the semantic relationships of attack word combinations such as php: / / input, forming a unified semantic expression across scripts and families, suitable for generalized detection and clustering analysis of attack behaviors.

[0108] The token feature extraction is illustrated in one of the following feasible embodiments:

[0109] To model the basic semantic content of scripts, this paper proposes TokenShell2Vec features at the lexical level. This method first performs lexical segmentation on the source code to extract basic syntactic units such as keywords, operators, and function identifiers, and then uses WordShellVec embeddings to represent the contextual dependencies of these tokens.

[0110] The specific extraction steps are as follows:

[0111] A tag co-occurrence graph is constructed by analyzing frequency and contextual distribution; a dense vector is generated for each tag using the WordShellVec embedding model; and the final vector sequence is concatenated using the following formula.

[0112]

[0113] in, The final semantic vector representation of the token features is represented by TokenShellVec(·), which represents the vector generation function for the token features, and T represents the input token sequence. A token represents a semantic vector, typically with dimensions of 100 to 300, where n represents the total number of basic syntactic units in the token sequence obtained after the WebShell script has been lexically tokenized.

[0114] This sequence can be directly used as input to deep neural networks to support behavior prediction and malware family classification. Compared to rule-based shallow features, the Token2Vec method is more adaptable to structural variations and linguistic diversity, and is particularly suitable for extracting a unified representation from semantically clear code decrypted by LLM.

[0115] In one of the following feasible embodiments, AST feature extraction is described:

[0116] To address the common control flow obfuscation and syntax distortion issues in WebShell attacks, the script is parsed into a multi-branch tree structure, and the context and syntax attributes of each node are extracted to form a semantic sequence.

[0117] This invention first uses PHP-Parser, JScriptParser, and Java Parser to convert the S-script into an AST, and then traverses the nodes level by level and performs semantic transformations, such as... ; .

[0118] The path set is constructed and vectorized using the following formula.

[0119]

[0120] in, The vector form representing the features of an AST. It is a function that extracts features from the script's abstract syntax tree. This represents the mechanism for converting AST features into dense vectors.

[0121] The Flow feature extraction is illustrated in one of the following feasible embodiments:

[0122] Given the importance of control flow transitions and data dependencies for understanding attack intent, this invention constructs a global execution flow view of the script by combining the control flow graph (CFG) and data flow graph (DFG), and uses a graph convolutional network (GCN) to extract global dependency features.

[0123] The control flow graph includes: Data flow diagram: The embedding and combination process is represented by the following formula.

[0124]

[0125]

[0126] in, Represents the control flow feature vector. Represents the feature vector of the data stream. This represents the global dependency feature vector of Flow.

[0127] This feature can capture branching structures, dependencies between statements, and causal logic of multi-stage commands, thereby significantly enhancing the model's ability to detect complex attack processes.

[0128] In one of the following feasible embodiments, the junction Figure 3 and Figure 6 The following explains the multi-view feature fusion:

[0129] First, the embedding vectors of different views are aligned—since the dimensions of each feature differ in different views, padding is required to unify the vector length.

[0130] Next, this invention constructs a fusion function that maps the aligned embedding vectors to a shared feature space, generating a high-order comprehensive feature with a highly unified representation, denoted as . .

[0131] To address the issue of incomplete feature coverage in the test set, unknown markers were introduced to label unrecognized features. Finally, Input into the classifier for WebShell detection and family identification.

[0132] The multi-view embedding fusion formula is as follows:

[0133]

[0134] in, divide and sum These represent the features corresponding to TokenShell, ASTShell, WordShell, and FlowShell, respectively. Used to align different features into a common space This is used to map the aligned features to the corresponding feature space, generating a representation. This represents the final multi-view fusion feature.

[0135] The model construction is illustrated in one of the following feasible embodiments:

[0136] This invention constructs a hybrid detection model called "ResNet-BiLSTM-Transformer", which aims to identify and classify WebShell malicious code and perform fine-grained behavioral classification of the malicious code.

[0137] The model achieves multi-view feature fusion through ResNet, Bi-LSTM (BiLSTM), and Transformer-based global semantic encoding, and uses softmax for classification.

[0138] The local pattern extractor uses 1D-ResNet layers. ResNet captures local patterns through residual connections, alleviating the gradient vanishing and low training efficiency problems common in deep neural networks.

[0139] In this layer, the convolution operation uses multiple kernels to extract local features from the input feature map, while the ReLU activation function introduces a non-linear transformation to enhance the model's representational power.

[0140] Subsequently, max pooling is applied to the feature maps to reduce the dimensionality of the feature space while preserving key high-resolution features—a step that improves the computational efficiency and robustness of the network.

[0141] In WebShell detection scenarios, the ResNet layer helps capture low-level local patterns in WebShell scripts, such as recurring malicious function calls and code block structures.

[0142] The calculation formula is as follows:

[0143]

[0144] Where x represents the input feature tensor, This indicates that a depthwise convolution operation is performed on the input feature tensor. This represents the kernel or dimension configuration of a depthwise convolution. This indicates that batch normalization is performed on the output of the depthwise convolution. This indicates that the linear rectification activation function is applied to the batch-normalized output.

[0145] BiLSTM (Bidirectional Long Short-Term Memory Network) is used to capture long-term dependencies in time series data and can effectively handle sequence features in WebShell scripts.

[0146] Unlike standard LSTM, BiLSTM employs a bidirectional propagation mechanism, simultaneously capturing forward information from previous time steps and backward information from subsequent time steps, thereby enhancing its ability to model long-distance dependencies.

[0147] The formulas for BiLSTM to hide the forward and backward states are shown below:

[0148]

[0149] in, This represents the hidden state of the feedforward LSTM at time t. This represents the hidden state of the feedforward LSTM at time t. This represents the input sequence element at time t. This represents a computational unit in a long short-term memory network.

[0150] Transformer is a model based on self-attention mechanism that can capture global dependencies and cross-location interactions.

[0151] In WebShell detection, Transformer helps extract more refined semantic information from the global context, enhancing the model's ability to identify complex and distributed attack chains.

[0152] Through the multi-head self-attention mechanism (MHSA), the Transformer can focus on different parts of the input data and perform information fusion at different levels.

[0153] For WebShell detection tasks, the Transformer's multi-head self-attention mechanism provides powerful contextual understanding capabilities, enabling the model to identify key patterns and behavioral encodings in malicious code. To further model long-distance dependencies and cross-location interactions, the output H is fed into the MHSA + Transformer encoder.

[0154] For the j-th attention head:

[0155]

[0156]

[0157] in, Let j represent the input feature matrix, and j represent the attention head index. This represents the query matrix of the j-th attention head. This represents the weight matrix of the j-th attention head query mapping. This represents the key matrix of the j-th attention head. express The transpose of the matrix, This represents the key mapping matrix of the j-th attention head. This represents the value matrix of the j-th attention head. This represents the value mapping matrix of the j-th attention head. This is the scaling factor.

[0158] Final output:

[0159]

[0160] in, Let h represent the set of outputs of the attention heads, and h represent the total number of attention heads. This indicates the output linear transformation weight matrix.

[0161] The global context representation Z_L can be generated by stacking residual connections and feedforward layers. This module can align multi-stage attack chains (e.g., decoding → parsing → command execution), thereby improving the detection capability for complex, distributed logic.

[0162] Softmax and linear layers serve as feature mapping modules for classification tasks.

[0163] The linear layer maps the high-dimensional feature vector output by the previous Transformer layer to a low-dimensional space that matches the classification category dimension.

[0164] Its function is to integrate global features through linear transformation, providing a basis for subsequent probability output.

[0165] The Softmax layer normalizes the output of the linear layer, transforming it into a probability distribution for each classification category, in order to make the final classification decision.

[0166] This model first performs a binary classification to distinguish between normal scripts and malicious scripts. For scripts identified as malicious, it further categorizes them into seven specific behavior types through fine-grained behavior classification (command execution, file operations, database access, information gathering, network communication, privilege escalation, and obfuscation evasion), such as... Figure 4 As shown.

[0167] The technical terms, principles, or means related to the technical solutions of the present invention mentioned in the above embodiments, which are not described in detail above, are all well-known technologies or common practices that are known to those skilled in the art.

[0168] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A fine-grained method for detecting malicious WebShell behavior based on abstract syntax trees and deobfuscation, characterized in that, This includes the computer performing the following steps: Input suspicious WebShell script files into the computer system, and quickly identify and standardize the suspicious scripts through file format screening, feature matching, and file standardization to obtain standardized scripts; The normalized script is deobfuscated based on a large language model to obtain simplified and semantically equivalent code. The code is parsed to generate an abstract syntax tree. Dangerous function call detection, expression and variable flow analysis, control flow depth statistics, and concatenation operator frequency analysis are extracted through a multi-granularity feature extraction mechanism, while capturing multi-dimensional context dependencies. After extracting multidimensional features and vectorizing them, feature fusion is performed, and the input is a deep neural network combining ResNet, BiLSTM and Transformer; The computer system processor executes computer programs and outputs WebShell malicious behavior detection results and fine-grained classification results of malicious behavior; Specifically, the process of parsing the code to generate an abstract syntax tree involves using a corresponding parser to generate a consistent abstract syntax tree representation for different scripting languages. The multi-granularity feature extraction mechanism simultaneously analyzes control flow and data dependency features, enhancing the complete capture of the multi-dimensional context dependencies; The multidimensional features include Word features, Token features, AST features, and Flow features; The extraction of the AST features includes: For different script files, a corresponding parser is used to convert them into ASTs. The nodes are traversed level by level to perform semantic transformation. The AST feature vector generation formula is used to construct a path set and then vectorize it. The extraction of the Flow features includes: A global execution flow view is constructed by combining control flow graphs and data flow graphs, and global dependency features are extracted through graph convolutional networks. The control flow graph includes: Data flow diagram: The embedding and combination process is represented by the following formula; in, Represents the control flow feature vector. Represents the feature vector of the data stream. This represents the global dependency feature vector of Flow.

2. The fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation as described in claim 1, characterized in that, The file format screening checks the extensions and header signatures of suspicious WebShell script files, retaining script files that belong to the Web script type. The feature matching includes using multi-granular keyword statistics, regular expression pattern detection, and function sequence pattern comparison on the script files belonging to the Web script type to quickly identify potential WebShell features and judge the scripts; The document standardization process specifically involves standardizing the format of scripts deemed suspicious or malicious. This standardization process includes removing blank lines, removing comments, unifying character encoding and indentation style, and finally outputting the standardized script.

3. The fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation as described in claim 2, characterized in that, The regular pattern detection includes: A global scan is performed on script files that belong to the Web script type, and the frequency of high-risk functions is counted. If the frequency exceeds a set threshold, the function is marked as suspicious. Use regular expressions to match decoding chains and dynamic execution patterns to capture suspicious behavior such as multi-layer decoding or dynamic parameter injection; Construct a function call chain and compare it with known WebShell behavior sequences. Use the LCS algorithm to calculate the similarity and determine whether the script file belonging to the Web script type has WebShell characteristics.

4. The fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation as described in claim 1, characterized in that, The extraction of the Word features includes: Lexical semantic features of WebShell scripts are extracted using code semantic normalization technology. After full-width to half-width conversion and keyword case uniform cleaning, high-frequency semantic words related to attacks, as well as string features related to file system and command execution are extracted. Then, the WordShellVec mechanism is used to construct an adjacency matrix based on word context co-occurrence relationships, and to learn dense word vectors using the Skip-Gram architecture to capture semantic associations of attack words.

5. The fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation as described in claim 1, characterized in that, The extraction of the token features includes: Lexical tokenization of the WebShell script is performed to obtain a token sequence; A marker co-occurrence graph is constructed by analyzing frequency and contextual distribution; The WordShellVec embedding model is used to generate dense vectors for each token, and the final vector sequence is concatenated using the WebShell lexical semantic vector generation formula. The formula for generating WebShell semantic vectors is as follows: in, The final semantic vector representation of the token features is given by TokenShellVec(·), where TokenShellVec(·) represents the vector generation function for the token features, and T represents the input token sequence. This represents the semantic vector of a tag, where n represents the total number of basic syntactic units in the tag sequence obtained after the WebShell script has been lexically tokenized.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed, the program implements the fine-grained method for WebShell malicious behavior based on abstract syntax trees and deobfuscation as described in any one of claims 1 to 5.

Images