Web Shell Classifier Training Using ML Feature Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for detecting web shell applications are vulnerable to shifts in attacker behavior and require the file to be running to determine if it is malicious, often resulting in false positives and inadequate security against unauthorized access.
Innovation Solution
A method and system that utilize machine learning to classify files as web shell or non-web shell applications by extracting and analyzing static and dynamic features, such as index of coincidence, entropy rate, system function calls, and behavior in a controlled environment, using classifiers like gradient boosting and Extra Trees to provide probabilistic assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional signature-based detection methods are used, then detection simplicity is maintained, but detection accuracy deteriorates due to vulnerability to attacker behavior shifts
Solution Approach 1:
The patent transforms the detection approach by changing from static signature parameters to dynamic behavioral parameters. Instead of relying on fixed file signatures, the system extracts multiple features (entropy rate, index of coincidence, function call patterns, nesting levels) and uses machine learning classifiers to detect web shells based on their behavioral characteristics, thereby improving detection accuracy against evolving threats.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based classification system. Gradient boosting and Extra Trees classifiers are trained on extracted features to automatically identify web shells, substituting the rigid mechanical comparison process with an adaptive intelligent system that can generalize to unknown threats.
2Reliability
If file execution is required for detection, then detection completeness improves, but system security deteriorates due to potential damage from executing malicious files
Solution Approach 1:
The patent performs preliminary analysis by extracting static features (entropy rate, index of coincidence, function call patterns) from files before execution. This preliminary action allows the system to identify suspicious characteristics and classify potential web shells without actually executing the files, thus maintaining detection completeness while eliminating the security risk of running malicious code.
Solution Approach 2:
The patent introduces a controlled analysis environment that acts as an intermediary between the file and the system. By analyzing files in this isolated intermediate state and using machine learning classifiers to evaluate extracted features, the system can safely determine maliciousness without direct execution on the target system.
3Adaptability or versatility
If manually defined rules are used for detection, then ease of implementation is maintained, but adaptability deteriorates due to inability to respond to new attack patterns
Solution Approach 1:
The patent introduces dynamics into the detection system by using machine learning classifiers that can adapt to new attack patterns. The gradient boosting and Extra Trees models are trained on extracted features and can generalize to previously unseen web shell variants, providing dynamic adaptability compared to static manual rules while maintaining a structured analytical framework.
Data Source
AI summary
Methods and systems for identifying malicious applications and, more particularly, to identifying web shell applications. Embodiments described herein rely on machine learning tools to analyze static and dynamic features of a suspected file to determine whether the file is a web shell application.