Research of Webshell Detection Based on Decision Tree
Duohe Ma · 2012
Webshell is a kind of backdoors based on web service.The attacker can obtain Web service management authority by Webshell,so as to achieve the goal of Web service penetration and control.There is little difference between malicious webshell pages and normal webpage,and it can easily escape from detection of traditional firewall and anti-virus software.As Webshell has applied various anti-finding techniques to hide its characteristics,it is not effective to use traditional way based on feature matching to detect variant Webshell.This paper discusses the characteristics and mechanism of Webshell,explores its important features,proposes and implements a detection model based on decision tree algorithm.This model is a kind of supervised machine learning system,it can detect variant Webshell by prior training webpage learning,to make up for the defects of traditional detection method based on feature matching.Combined with Boosting,which is a kind of collective learning method,the stability of this model is further enhanced,and the classification accuracy rate is improved as well.