The invention discloses a detection method and system of a RASP-based PHP deformed webshell. For the detection system, by deploying RASP probes, it is detected that the programming language is a deformed webshell of PHP; including: a preliminary detection module, a context acquisition module, and a marked Parameter monitoring module, judging module, post-analysis module and after-the-fact traceability module; Utilize the technical scheme provided by the present invention, deformed webshell can be blocked by preliminary detection module and RASP, greatly reduce the false positive rate and false positive rate of webshell detection; And utilize Tracking and monitoring by RASP can better understand the causes of vulnerabilities, so as to apply patches for vulnerabilities; through reasonable deployment of probes, 0day vulnerabilities can also be discovered to prevent problems before they happen. In addition, the performance loss of the present invention is very small, and can be widely used.