Research on Webshell Detection Method Based on Machine Learning
Tianmin Guan, Jiemin Zhang, Jian Mao · 2019 3rd International Conference on Electronic Information Technology and Computer Engineering (EITCE) · 2019
Webshell is a command execution environment which existing by the form of web file like ASP, PHP, JSP and CGI. At the same time, it is also the web site back door that utilized by attackers. The traditional method of detecting webshell is based on rule matching technology, but it results a higher missed detection rate because the variant PHP webshell is dynamic, numerous and disguised. Based on Machine Learning, a webshell detection method was proposed. opcode+N-Gram+TF-IDF was applied for sample characterization, and four Machine Learning algorithms XGBoost, MLP, RF and NB were selected to train detection models. Through the analysis of experimental data, an optimal PHP webshell detection model based on XGBoost algorithm is showed, and the detection accuracy is more than 97% under the experimental conditions. Experimental data specify that the detection method based on Machine Learning can effectively improve the detection accuracy of variant PHP webshell.