Webshell malicious traffic detection method based on multi-feature fusion

Yuan LI; Yunpeng WANG; Tao LI; Baoqiang MA

doi:10.11959/j.issn.2096-109x.2021103

您当前的位置：

首页 >

文章列表页 >

Webshell malicious traffic detection method based on multi-feature fusion

Papers | 更新时间：2024-06-03

- Webshell malicious traffic detection method based on multi-feature fusion
- Chinese Journal of Network and Information Security Vol. 7, Issue 6, Pages: 143-154(2021)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021103
  CLC： TP393
- Online First：2021-12，
  
  Published：15 December 2021
- 稿件说明：
移动端阅览
Yuan LI, Yunpeng WANG, Tao LI, et al. Webshell malicious traffic detection method based on multi-feature fusion[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 143-154.
DOI：

Yuan LI, Yunpeng WANG, Tao LI, et al. Webshell malicious traffic detection method based on multi-feature fusion[J]. Chinese Journal of Network and Information Security, 2021, 7(6): 143-154. DOI： 10.11959/j.issn.2096-109x.2021103.

摘要

Webshell是针对Web应用系统进行持久化控制的最常用恶意后门程序，对Web服务器安全运行造成巨大威胁。对于 Webshell 检测的方法大多通过对整个请求包数据进行训练，该方法对网页型 Webshell 识别效果较差，且模型训练效率较低。针对上述问题，提出了一种基于多特征融合的Webshell恶意流量检测方法，该方法以Webshell的数据包元信息、数据包载荷内容以及流量访问行为3个维度信息为特征，结合领域知识，从3个不同维度对数据流中的请求和响应包进行特征提取；并对提取特征进行信息融合，形成可以在不同攻击类型进行检测的判别模型。实验结果表明，与以往研究方法相比，所提方法在正常、恶意流量的二分类上精确率得到较大提升，可达99.25%；训练效率和检测效率也得到了显著提升，训练时间和检测时间分别下降95.73%和86.14%。

Abstract

Webshell is the most common malicious backdoor program for persistent control of Web application systems

which poses a huge threat to the safe operation of Web servers.For most Webshell detection method based on the request packet data for training

the method for web-based Webshell recognition effect is poorer

and the model of training efficiency is low.In response to the above problems

a Webshell malicious traffic detection method based on multi-feature fusion was proposed.The method was characterized by the three dimensions of Webshell packet meta information

packet payload content and traffic access behavior.Combining domain knowledge

feature extraction of request and response packets in the data stream.Transformed into feature extraction information for information fusion

forming a discriminant model that could detect different types of attacks.Compared with the previous research method

the accuracy rate of the method here in the two classification of normal and malicious traffic has been improved to 99.25%.The training efficiency and detection efficiency have also been significantly improved

and the training time and detection time have been reduced by 95.73% and 86.14%.

关键词

Keywords

references

2019中国主机安全服务报告 [R ] .

2019 China Host Security Service Report [R ] .

W3Techs W3Techs.Usage of server-side programming languages for websites [EB ] . 2020 .

戴桦 , 李景 , 卢新岱 , 等 . 智能检测Webshell的机器学习算法 [J ] . 网络与信息安全学报 , 2017 , 3 ( 4 ): 51 - 57 .

DAI H , LI J , LU X D , et al . Machine learning algorithm for intelligent detection of Webshell [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 4 ): 51 - 57 .

XU M K , CHEN X , HU Y . Design of software to search ASP Web shell [J ] . Procedia Engineering , 2012 , 29 : 123 - 127 .

AI Z , LUKTARHAN N , ZHAO Y X , et al . WS-LSMR:malicious WebShell detection algorithm based on ensemble learning [J ] . IEEE Access , 2020 , 8 : 75785 - 75797 .

崔艳鹏 , 史科杏 , 胡建伟 . 基于XGBoost算法的Webshell检测方法研究 [J ] . 计算机科学 , 2018 , 45 ( S1 ): 375 - 379 .

CUI Y P , SHI K X , HU J W . Research of webshell detection method based on XGBoost algorithm [J ] . Computer Science , 2018 , 45 ( S1 ): 375 - 379 .

LI T T , REN C H , FU Y S , et al . Webshell detection based on the word attention mechanism [J ] . IEEE Access , 2019 , 7 : 185140 - 185147 .

WU Y X , SUN Y Q , HUANG C , et al . Session-based Webshell detection using machine learning in web logs [J ] . Security and Communication Networks , 2019 , 2019 : 1 - 11 .

YANG W C , SUN B , CUI B J . A Webshell detection technology based on HTTP traffic analysis [M ] // Innovative Mobile and Internet Services in Ubiquitous Computing . Cham ： Springer International Publishing ， 2018 , 336 - 342 .

ZHANG H , GUAN H C , YAN H B , et al . Webshell traffic detection with character-level features based on deep learning [J ] . IEEE Access , 2018 , 6 : 75268 - 75277 .

RODOFILE N , RADKE K , FOO E . Real-time and interactive attacks on DNP3 critical infrastructure using Scapy [R ] . 2015 .

BERNERS-LEE T , FIELDING R , MASINTER L . Uniform resource identifier (URI):generic syntax [R ] . RFC Editor , 2005 .

STAROV O , DAHSE J , AHMAD S S , et al . No honor among thieves:a large-scale analysis of malicious Web shells [C ] // Proceedings of the 25th International Conference on World Wide Web . 2016 : 1021 - 1032 .

BEAL M J , GHAHRAMANI Z , RASMUSSEN C E . The infinite hidden Markov model [C ] // Advances in Neural Information Processing Systems . 2002 : 577 - 584 .

ZHANG J , LI Z Y , NAI K , et al . DELR:a double-level ensemble learning method for unsupervised anomaly detection [J ] . Knowledge-Based Systems , 2019 , 181 : 104783 .

GIACINTO G , ROLI F . An approach to the automatic design of multiple classifier systems [J ] . Pattern Recognition Letters , 2001 , 22 ( 1 ): 25 - 33 .

Scikit-learn website [EB ] .

CHAWLA N V , BOWYER K W , HALL L O , et al . SMOTE:synthetic minority over-sampling technique [J ] . Journal of Artificial Intelligence Research , 2002 , 16 : 321 - 357 .

KRSTINIĆ D , BRAOVIĆ M , ŠERIĆ L . Multi-label classifier performance evaluation with confusion matrix [C ] // Proceedings of Computer Science ＆ Information Technology . 2020 : 1 - 14 .

Views

524

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Multi-source forgery detection method based on the fusion of color space features and frequency domain features

FLWD:A Webshell detection method based on federated learning

Multi-feature fusion malware detection method based on attention and gating mechanisms

Temporal link prediction method based on community multi-features fusion and embedded representation

Encrypted traffic classification method based on convolutional neural network

Related Author

Wang Jiabao

Li Yang

Zhang Qi

Wang Jun

Miao Zhuang

Hou Yifan

WU Shuixiu

CHAI Jiangli

Related Institution

Institute of Command-and-Control Engineering, Army Engineering University of PLA

School of Mathematics and Computer Sciences, Nanchang University

School of Computer Information Engineering, Jiangxi Normal University

College of Cyber Security, Jinan University

China Internet Network Information Center

⁰