Webshell Detection via Visit Record Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current webshell detection methods face low detection efficiency due to the high volume of web traffic, requiring extensive processing resources and resulting in inefficient inspection performance.
Innovation Solution
A webshell detection method that constructs a web page visit record to identify suspicious URLs based on visit quantity and IP address distribution, focusing detection on these URLs rather than all web pages, thereby reducing the number of pages that need to be inspected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If webshell detection is performed on all web pages, then detection completeness is improved, but processing resource consumption increases and detection efficiency decreases
Solution Approach 1:
The patent segments web pages into suspicious and normal categories based on visit record analysis. By dividing the detection scope into two segments (suspicious URLs requiring full inspection vs. normal URLs requiring no inspection), the system maintains detection completeness for suspicious pages while reducing overall processing resources consumed on all web pages.
Solution Approach 2:
The patent applies local quality by differentiating detection intensity based on URL characteristics. Suspicious URLs (identified through visit record analysis showing low visit counts and concentrated IP addresses) receive full detection inspection, while normal URLs are excluded from detection. This localized approach ensures high detection efficiency for critical areas without wasting resources on safe areas.
2Productivity
If visit record analysis is performed to identify suspicious URLs, then detection efficiency is improved by reducing inspection scope, but system complexity increases
Solution Approach 1:
The patent implements preliminary action by analyzing visit records before performing webshell detection. The system first collects visit record data, identifies suspicious URLs based on predefined criteria (low visit counts, concentrated IP addresses), and then focuses detection only on these pre-identified suspicious URLs. This preliminary sorting action reduces detection efficiency by avoiding unnecessary inspections while introducing manageable system complexity through visit record collection and analysis mechanisms.
Data Source
AI summary
A webshell detection method and apparatus are provided. The apparatus obtains first web traffic of a protected host; generates a web page visit record of the protected host based on the first web traffic, where the web page visit record is used to save at least one uniform resource locator (URL), an IP address visiting each URL, and a total quantity of visits to each URL; determines a suspicious URL from the at least one URL based on the web page visit record, where a total quantity of visits to the suspicious URL is less than a first threshold, and a ratio of a quantity of different IP addresses visiting the suspicious URL to the total quantity of visits to the suspicious URL is less than a second threshold; and determines whether a web page identified by the suspicious URL contains a webshell signature.