Research on Webshell Detection Based on Semantic Analysis and Text-CNN

Webshell, a kind of web page-based backdoor, is widely used in network attacks. There are many methods used for Webshell detection. A method based on bytecode of JSP scripts and Abstract Syntax Tree of PHP fails to see the similarities between different script languages. What's more, an approach based on raw script's content and CNN model only focuses on PHP Webshell and does poorly in the extraction of Webshell's features. Therefore, this paper proposes a generic Webshell detection model based on Text-CNN by extracting the node sequence of the Abstract Syntax Tree of PHP and JSP Webshell. The experimental results show that, compared to the traditional static detection model, the proposed detection model significantly improves detection rate, where the detection accuracy achieves as high as 99.5%.