WebShell Attack Detection Based on a Deep Super Learner

Abstract

WebShell is a common network backdoor attack that is characterized by high concealment and great harm. However, conventional WebShell detection methods can no longer cope with complex and flexible variations of WebShell attacks. Therefore, this paper proposes a deep super learner for attack detection. First, the collected data are deduplicated to prevent the influence of duplicate data on the result. Second, to detect the results of the algorithm, static and dynamic feature are taken as the feature of the algorithm to construct a comprehensive feature set. We then use the Word2Vec algorithm to vectorize the features. During this period, to prevent the outbreak of the number of features, we use a genetic algorithm to extract the validity of the feature dimension. Finally, we use a deep super learner to detect WebShell. The experimental results show that this algorithm can effectively detect WebShell, and its accuracy and recall are greatly improved.

A New Method for WebShell Detection Based on Bidirectional GRU and Attention Mechanism

“…Compared with the multi-layer perceptron method in reference [32], the accuracy of the method proposed in this study is improved by nearly 5%, the accuracy is improved by more than 6%, and the recall rate and F1 value are also greatly improved. Although the accuracy of the method in reference [33] is higher than that in this article, the accuracy of our method is improved by 0.45%, recall rate is improved by 2.87%, and F1 value is improved by 0.94%. For further analysis, we found the total number of WebShell samples in the dataset used in reference [33] is only 571, while the number of normal samples is 5379, the ratio is close to 1:10, the division ratio of training set and validation set is 7:3, and the number of WebShells in the verification set is only 172.…”

“…By inputting the word vector obtained after preprocessing, the accuracy of the LSTM network and the GRU network both exceeded 98%, indicating that the extracted word vector as the original feature is feasible for WebShell detection. When using a GRU network, the algorithm's recall rate is 95.8%, which means that there will only 5 false We compared the methods proposed in references [4,6,32,33], and the performance indicators of each method are listed in Table 6.…”

“…is scheme has achieved good results, but each performance needs to be further improved. Reference [33] is an ensemble learning algorithm that combines logistic regression algorithm, multi-layer perceptron, and random forest algorithm, using multiple weak classifiers to integrate into a strong classifier, and it achieved 99.25% accuracy on the experimental dataset. Compared with the above four schemes, the method in this study has improved performance in varying degrees except that the accuracy is lower than the scheme proposed in reference [33].…”

“…Reference [33] is an ensemble learning algorithm that combines logistic regression algorithm, multi-layer perceptron, and random forest algorithm, using multiple weak classifiers to integrate into a strong classifier, and it achieved 99.25% accuracy on the experimental dataset. Compared with the above four schemes, the method in this study has improved performance in varying degrees except that the accuracy is lower than the scheme proposed in reference [33]. Compared with the multi-layer perceptron method in reference [32], the accuracy of the method proposed in this study is improved by nearly 5%, the accuracy is improved by more than 6%, and the recall rate and F1 value are also greatly improved.…”

BERT-Embedding-Based JSP Webshell Detection on Bytecode Level Using XGBoost

“…Webshell can be transformed into sequential text information by some means. Word2vec is a tool that can transform text information into word vectors and is used for webshell detection [34]. Tong [35] extracted word vectors from the native webshell using BERT.…”