Encrypted and obfuscation WebShell detection for high-speed network traffic

Yihuai CAO; Wei CHEN; Fan ZHANG; Lifa WU

doi:10.11959/j.issn.2096-109x.2022055

您当前的位置：

首页 >

文章列表页 >

Encrypted and obfuscation WebShell detection for high-speed network traffic

Papers | 更新时间：2024-06-03

- Encrypted and obfuscation WebShell detection for high-speed network traffic
- Chinese Journal of Network and Information Security Vol. 8, Issue 4, Pages: 119-130(2022)
- 作者机构：
  
  1. 南京邮电大学计算机学院，江苏南京 210023
  2. 武汉轻工大学数学与计算机学院，湖北武汉 430048
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2022055
  CLC： TP393
- Online First：2022-08，
  
  Published：15 August 2022
- 稿件说明：
移动端阅览
Yihuai CAO, Wei CHEN, Fan ZHANG, et al. Encrypted and obfuscation WebShell detection for high-speed network traffic[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 119-130.
DOI：

Yihuai CAO, Wei CHEN, Fan ZHANG, et al. Encrypted and obfuscation WebShell detection for high-speed network traffic[J]. Chinese Journal of Network and Information Security, 2022, 8(4): 119-130. DOI： 10.11959/j.issn.2096-109x.2022055.

摘要

WebShell 是一种常见的 Web 脚本入侵工具。随着流量加密和代码混淆等技术的逐渐发展，使用传统的文本内容特征和网络流特征进行匹配的检测手段越来越难以防范生产环境下复杂的 WebShell 恶意攻击事件，特别是对于对抗性样本、变种样本或 0Day 漏洞样本的检测效果不够理想。搭建网络采集环境，在高速网络环境中利用数据平面开发套件（DPDK，data plane development kit）技术捕获网络数据包，标注了一套由1万余条不同平台、不同语言、不同工具、不同加密混淆方式的WebShell恶意流量与3万余条正常流量组成的数据集；通过异步流量分析系统框架和轻量型日志采集组件快速地解析原始流量，并融合专家知识深度分析几种流行的WebShell管理工具通信过程中的HTTP数据包，从而构建面向加密混淆型WebShell流量的有效特征集；基于该有效特征集使用支持向量机（SVM，support vector machine）算法实现对加密混淆型 WebShell 恶意流量的离线训练和在线检测。同时，利用遗传算法改进参数搜索方式，克服了由人工经验设置参数方位以及网格搜索陷入局部最优解的缺点，模型训练效率也得到提升。实验结果显示，在自建的WebShell攻击流量数据集上，保证了检测高效性的同时，检测模型的精确率为97.21%，召回率为98.01%，且在对抗性WebShell攻击的对比实验中表现良好。结果表明，所提方法能够显著降低WebShell攻击风险，可以对现有的安全监控体系进行有效补充，并在真实网络环境中部署和应用。

Abstract

With the gradual development of traffic encryption and text obfuscation technologies

it is increasingly difficult to prevent complicated and malicious WebShell attack events in production environment using traditional detection methods based on text content and network flow features

especially for adversarial samples

variant samples and 0Day vulnerability samples.With the established network traffic collection environment

DPDK technology was used to capture network traffic in the high-speed network environment

and a dataset was marked with label.The dataset consisted of more than 24

000 normal traffic and more than 10

000 malicious WebShell traffic under different platforms

different languages

different tools

different encryption and obfuscation methods.Then Asynchronous traffic analysis system framework and lightweight log collection components were used to efficiently parse raw traffic.Expert knowledge was integrated to analyze HTTP data packets during the communication process of several popular WebShell management tools

and the effective feature set for encrypted and obfuscation WebShell was obtained.Support Vector Machine (SVM) algorithm was used to realize offline training and online detection of complicated WebShell malicious traffic based on the effective feature set.Meanwhile

improving the parameter search method with the genetic algorithm promoted the model training efficiency furthermore.The experimental results showed that the detection efficiency can be guaranteed based on the self-built WebShell attack traffic dataset.Besides

the detection model has a precision rate of 97.21% and a recall rate of 98.01%

and it performed well in the comparative experiments of adversarial WebShell attacks.It can be concluded from the results that the proposed method can significantly reduce the risk of WebShell attack

effectively supplement the existing security monitoring system

and be applied in real network environments.

关键词

Keywords

references

国家互联网应急响应中心 . 2020 年我国互联网网络安全态势综述 [EB ] .

CNCERT/CC . Overview of China’s Internet security posture in 2020 [EB ] .

BEHRENS S , HAGEN B . Web shell detection using NeoPI [EB ] .

石刘洋 , 方勇 . 基于Web日志的Webshell检测方法研究 [J ] . 信息安全研究 , 2016 , 2 ( 1 ): 66 - 73 .

SHI L Y , FANG Y . Research on Webshell detection method based on Web log [J ] . Journalof Information Security Research , 2016 ,( 1 ): 66 - 73 .

YANG C H , SHEN C H . Implement web attack detection engine with snort by using modsecurity core rules [C ] // Fourth the E-Learning and Information Technology Symposium (EITS 09) . 2009 .

宋明璐 . 基于主动学习的CNN Webshell检测 [D ] . 北京：北京交通大学 , 2021 .

SONG M L . CNN Webshell detection based on active learning [D ] . Beijing:Beijing Jiaotong University , 2021 .

龙啸 , 方勇 , 黄诚 , 等 . Webshell 研究综述:检测与逃逸之间的博弈 [J ] . 网络空间安全 , 2018 , 9 ( 1 ): 62 - 68 .

LONG X , FANG Y , HUANG C , et al . Webshell research review:the confrontation between detection and escape [J ] . Cyber Security , 2018 , 9 ( 1 ): 62 - 68 .

STAROV O , DAHSE J , AHMAD S S , et al . No honor among thieves:A large-scale analysis of malicious web shells [C ] // Proceedings of the 25th International Conference on World Wide Web . 2016 : 1021 - 1032 .

赵运弢 , 徐春雨 , 薄波 , 等 . 基于流量的WebShell行为分析与检测方法 [J ] . 网络安全技术与应用 , 2018 , 18 ( 4 ): 8 - 9 .

ZHAO Y T , XU C Y , BAO B , et al . WebShell behavior analysis and detection method based on traffic [J ] . Network Security Technology＆Application , 2018 , 18 ( 4 ): 8 - 9 .

HAAS S , SOMMER R , FISCHER M . Zeek-osquery:host-network correlation for advanced monitoring and intrusion detection [C ] // IFIP International Conference on ICT Systems Security and Privacy Protection . Springer,Cham , 2020 : 248 - 262 .

SANJAPPA S , AHMED M . Analysis of logs by using logstash [C ] // Proceedings of the 5th International Conference on Frontiers in Intelligent Computing:Theory and Applications . Springer,Singapore , 2017 : 579 - 585 .

CHEN L , LIU J , XIAN M , et al . Docker container log collection and analysis system based on ELK [C ] // 2020 International Conference on Computer Information and Big Data Applications (CIBDA) . IEEE , 2020 : 317 - 320 .

HARREMOËS P , TOPSOE F . Inequalities between entropy and index of coincidence derived from information diagrams [J ] . IEEE Transactions on Information Theory , 2001 , 47 ( 7 ): 2944 - 2960 .

曾理 , 叶晓舟 , 王玲芳 . DPDK 技术应用研究综述 [J ] . 网络新媒体技术 , 2020 , 9 ( 2 ): 1 - 8 .

ZENG L , YE X Z , WANG L F . Summary of DPDK Technology Application Research [J ] . Journal of Network New Media , 2020 , 9 ( 2 ): 1 - 8 .

刘奕 , 李建华 , 张一瑫 , 等 . 基于特征属性信息熵的网络异常流量检测方法 [J ] . 信息网络安全 , 2021 , 21 ( 2 ): 78 - 86 .

LIU Y , LI J H , ZHANG Y T , et al . Network abnormal traffic detec-tion method based on characteristic attribute information entropy [J ] . Netinfo Security , 2021 , 21 ( 2 ): 78 - 86 .

HESTERMAN J Y , CAUCCI L , KUPINSKI M A , et al . Maximumlikelihood Estimation With a Contracting-grid Search Algorithm [J ] . IEEE Transactions on Nuclear Science , 2010 , 57 ( 3 ): 1077 - 1084 .

SHARAFALDIN I , LASHKARI A H , GHORBANI A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // International Conference on Information Systems Security ＆ Privacy (ICISSP) . 2018 : 108 - 116 .

WU Y , SUN Y , HUANG C , et al . Session-based webshell detection using machine learning in web logs [J ] . Security and Communication Networks,2019 , 2019 .

Views

668

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Robust identification method of website fingerprinting against disturbance

IoT intrusion detection method for unbalanced samples

Survey on anomaly detection technology based on logs

Related Author

ZHANG Jingxi

LI Tengyao

TU Yukuan

LUO Xiangyang

ANTONG P

Wen CHEN

Lifa WU

Yingjun ZHANG

Related Institution

Information Engineering University

Key Laboratory of Cyberspace Situation Awareness of Henan Province

Trusted Computing and Information Assurance Laboratory,Institute of Software,Chinese Academy of Sciences

Network Security Corps of Beijing Municipal Public Security Bureau

⁰