Machine learning algorithm for intelligent detection of WebShell

Hua DAI; Jing LI; Xin-dai LU; Xin SUN

doi:10.11959/j.issn.2096-109x.2017.00126

您当前的位置：

首页 >

文章列表页 >

Machine learning algorithm for intelligent detection of WebShell

Papers | 更新时间：2024-06-03

- Machine learning algorithm for intelligent detection of WebShell
- Chinese Journal of Network and Information Security Vol. 3, Issue 4, Pages: 51-57(2017)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00126
  CLC： TP309
- Online First：2017-04，
  
  Published：15 April 2017
- 稿件说明：
移动端阅览
Hua DAI, Jing LI, Xin-dai LU, et al. Machine learning algorithm for intelligent detection of WebShell[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 51-57.
DOI：

Hua DAI, Jing LI, Xin-dai LU, et al. Machine learning algorithm for intelligent detection of WebShell[J]. Chinese Journal of Network and Information Security, 2017, 3(4): 51-57. DOI： 10.11959/j.issn.2096-109x.2017.00126.

摘要

WebShell是网络入侵的常用工具，具有威害性大、隐蔽性好等特点。目前的检测手段较简单，容易被绕过，难以对付复杂灵活的 WebShell。针对这些问题，提出一种智能检测 WebShell 的机器学习算法，通过对已知存在WebShell和不存在WebShell的页面进行特征学习，完成对未知页面的预测，灵活性、适应性较好。实验证明，相比传统的WebShell检测方法，该算法的检测效率、正确率更高，同时也能以一定概率检测出新型的WebShell。

Abstract

WebShell is a common tool for network intrusions

which has the characteristics of great harm and good concealment.The current detection method is relatively simple

and easy to be bypassed

so it is difficult to deal with complex and flexible WebShell.To solve these problems

a supervised machine learning algorithm was put forward to detect WebShell intelligently.By learning the features of existing WebShell and non-existing WebShell pages

the algorithm can make prediction of the unknown pages

and the flexibility and adaptability were both very good.Compared with the traditional WebShell detection methods

the experiment proves that the algorithm has higher detection efficiency and accuracy

and at the same time there is a certain probability to detect new types of WebShell.

关键词

Keywords

references

MENG Z , MEI R , ZHANG T , et al . Research of Linux WebShell detection based on SVM classifier [J ] . Netinfo Security , 2014 .

MINGKUN X , XI C , YAN H . Design of software to search ASP WebShell [J ] . Procedia Engineering , 2012 , 29 : 123 - 127 .

叶飞 , 龚俭 , 杨望 . 基于支持向量机的 WebShell 黑盒检测 [J ] . 南京航空航天大学学报 , 2015 , 47 ( 6 ): 924 - 930 .

YE F , GONG J , YANG W . Black box detection of WebShell based on support vector machine [J ] . Journal of Nanjing University of Aeronautics and Astronautics , 2015 , 47 ( 6 ): 924 - 930 .

胡建康 , 徐震 , 马多贺 , 等 . 基于决策树的 WebShell 检测方法研究 [J ] . 网络新媒体技术 , 2012 ( 6 ): 15 - 19 .

HU J K , XU Z , MA D H , et al . A decision tree based research on Webshell detection method [J ] . Network and New Media Technology , 2012 ( 6 ): 15 - 19 .

马立军 . 基于行为监测的窃密型木马检测研究 [J ] . 广西民族大学学报 , 2014 , 20 ( 2 ): 70 - 74 .

MA L J . A behavior monitoring based theft Trojan detection [J ] . Journal of Guangxi University for Nationalities , 2014 , 20 ( 2 ): 70 - 74 .

石刘洋 , 方勇 . 基于 Web 日志的 Webshell 检测方法研究 [J ] . 信息安全研究 , 2016 ( 1 ).

SHI L Y , FANG Y . Webshell detection method research based on Web log [J ] . Information Security Research , 2016 ( 1 ).

马艳发 . 基于WAF入侵检测和变异WebShell检测算法的Web安全研究 [D ] . 天津:天津理工大学 , 2016 .

MA Y F . Web security research based on WAF intrusion detection and mutation WebShell detection algorithm [D ] . Tianjin:Tianjin University of Technology , 2016 .

DENG L Y , DONG L L , CHEN Y H , et al . Lexical analysis for the WebShell attacks [C ] // The International Symposium on Computer,Consumer and Control,IEEE Computer Society . 2016 : 579 - 582 .

MURPHY K P . Machine learning:a probabilistic perspective [M ] . Massachusetts : MIT pressPress , 2012 .

BISHOP C M . Pattern recognition [J ] . Machine Learning , 2006 ,128.

HOU Y T , CHANG Y , CHEN T , et al . Malicious Web content detection by machine learning [J ] . Expert Systems with Applications , 2010 , 37 ( 1 ): 55 - 60 .

路永和 , 李焰锋 . 改进TE-IDF算法的文本特征项权值计算方法 [J ] . 图书情报工作 , 2013 , 57 ( 3 ): 90 - 95 .

LU Y H , LI Y F . An improved TE-IDF algorithm for calculating the weight of text feature [J ] . Library and Information Service , 2013 , 57 ( 3 ): 90 - 95 .

KHALID S , KHALIL T , NASREEN S . A survey of feature selection and feature extraction techniques in machine learning [C ] // Science and Information . 2014 : 372 - 378 .

彭行雄 , 肖如良 , 张桂刚 . 基于自适应提升的概率矩阵分解算法 [J ] . 计算机应用 , 2015 , 35 ( 12 ): 3497 - 3501 .

PENG X X , XIAO R L , ZHANG G G . Probabilistic matrix factorization algorithm based on Ada Boost [J ] . Computer Application , 2015 , 35 ( 12 ): 3497 - 3501 .

李航 . 统计学习方法 [M ] . 北京 : 清华大学出版社 , 2012 .

LI H . Statistical learning method [M ] . Beijing : Tsinghua University PressPress , 2012 .

SCHEIN A I , UNGAR L H . Active learning for logistic regression:an evaluation [J ] . Machine Learning , 2004 , 68 ( 3 ): 235 - 265 .

Views

8276

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FLWD:A Webshell detection method based on federated learning

Webshell malicious traffic detection method based on multi-feature fusion

Related Author

ZENG Qingpeng

CHAI Jiangli

WU Shuixiu

Yuan LI

Yunpeng WANG

Tao LI

Baoqiang MA

Related Institution

School of Mathematics and Computer Sciences, Nanchang University

School of Computer Information Engineering, Jiangxi Normal University

⁰