Affiliations: [a] College of Information Science and Engineering, Xinjiang University, Urumqi, China
| [b]
Xichang Satellite Launch Centre, Xichang, China
| [c] Network Centre, Xinjiang University, Urumqi, China
Correspondence:
[*]
Corresponding author. N. Luktarhan, Network Centre, Xinjiang University, Urumqi 830046, China. E-mail: nurbol@xju.edu.cn.
Abstract: A webshell is a common tool for network intrusion. It has the characteristics of considerable threat and good concealment. An attacker obtains the management authority of web services through the webshell to penetrate and control web applications smoothly. Because webshell and common web page features are almost identical, it can evade detection by traditional firewalls and anti-virus software. Moreover, with the application of various anti-detection feature hiding techniques to the webshell, it is difficult to detect new patterns in time based on the traditional signature matching method. Webshell detection has been proposed based on deep learning. First, a dataset is opcoded, and the source code and opcode code features are fused. Second, the processed dataset is reduced using the SRNN and an attention mechanism, and the capsule network improves complete predictions for unknown pages. Experiments prove that the algorithm has higher detection efficiency and accuracy than traditional webshell detection methods, and it can also detect new types of webshell with a certain probability.
