Renforcer la détection des webshells grâce à des méthodes basées sur l'apprentissage profond
Hà Lê Việt · HAL (Le Centre pour la Communication Scientifique Directe) · 2024
The increasing prevalence of webshell attacks poses a significant threat to web application security, necessitating the development of robust detection mechanisms. The dissertation clearly identifies two research directions: scanning web application source code and in-depth analysis of HTTP traffic to detect webshells. First, the dissertation proposes an advanced DL-Powered Source-Code Scanning Framework, called ASAF, that integrates signature-based techniques with deep learning algorithms to enhance the detection of both known and unknown webshells. We design the framework to facilitate the creation of customized detection models for various programming languages. For the interpreted language, the study chose PHP; for the compiled language, the dissertation chose ASP.NET to build a complete ASAF-based model for experimentation and comparison with other research results to prove its effectiveness.Second, the dissertation introduces a deep neural network that utilizes real-time HTTP traffic analysis of web applications to detect webshells. The study proposes an algorithm to improve the loss function applied in the deep learning model to solve the problem of data imbalance. To demonstrate its effectiveness, we experimented with and compared the model to other studies on the same CSE-CIC-IDS2018 dataset. We have also integrated the model with the NetIDPS system to improve its capacity to identify new webshells. From there, proactively prevent these attacks by automatically adding attack source IPs to the blacklist and creating rules to block URIs querying webshells on the web server.This research contribution has been demonstrated through 01 national patent, 2 SCI-E journals, 1 E-SCI journal, 1 national journal, 2 WoS conference papers and 1 pending patent, as well as being practically applied in the national research project, code number KC01.19/16-20, granted by Ministry of Science and Technology of Vietnam.