FLWD:A Webshell detection method based on federated learning

ZENG Qingpeng; CHAI Jiangli; WU Shuixiu

doi:10.11959/j.issn.2096-109x.2025033

您当前的位置：

首页 >

文章列表页 >

FLWD:A Webshell detection method based on federated learning

Papers | 更新时间：2025-06-30

- FLWD:A Webshell detection method based on federated learning
- Chinese Journal of Network and Information Security Vol. 11, Issue 3, Pages: 109-119(2025)
- 作者机构：
  
  1.南昌大学数学与计算机学院，江西南昌 330031
  2.江西师范大学计算机信息工程学院，江西南昌330022
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(62466028)
- DOI：10.11959/j.issn.2096-109x.2025033
  CLC： TP393
- Received：21 January 2025，
  
  Revised：2025-03-25，
  
  Published：25 June 2025
- 稿件说明：
移动端阅览
曾庆鹏, 柴江力, 吴水秀. FLWD:基于联邦学习的Webshell检测方法[J]. 网络与信息安全学报, 2025, 11(3): 109-119.

Format: ZENG Q P, CHAI J L, WU S X. FLWD:A Webshell detection method based on federated learning[J]. Chinese Journal of Network and Information Security, 2025, 11(3): 109-119.
曾庆鹏, 柴江力, 吴水秀. FLWD:基于联邦学习的Webshell检测方法[J]. 网络与信息安全学报, 2025, 11(3): 109-119. DOI： 10.11959/j.issn.2096-109x.2025033.

Format: ZENG Q P, CHAI J L, WU S X. FLWD:A Webshell detection method based on federated learning[J]. Chinese Journal of Network and Information Security, 2025, 11(3): 109-119. DOI： 10.11959/j.issn.2096-109x.2025033.

摘要

Webshell攻击是网络攻击中常用的手段，攻击者通过Webshell获得Web服务器的部分控制权实施恶意行为。Webshell运行具有隐蔽性，且攻击者会不断创建新的Webshell变体来逃避安全检测，同时服务器之间缺乏信息共享和协调，导致应对Webshell攻击的检测能力参差不齐，难以形成全面有效的防御体系。为应对以上挑战，提出了一种基于联邦学习的Webshell检测方法，该方法融合Webshell的抽象语法树节点值序列特征、代码结构特征、文本混淆度特征以及网络安全领域经验特征，基于文本卷积神经网络（text convolutional neural network

TextCNN）设计网络模型以学习Webshell样本的恶意行为。同时，基于联邦学习的FedAvg算法和差分隐私随机梯度下降（differentially private stochastic gradient descent

DP-SGD）算法实现数据不出域场景下多个参与方的协同训练，保障了参与方在联邦学习过程中的数据隐私，防止敏感信息泄露。实验结果显示，在AMWD

22数据集上，所提方法模型的检测准确率为99.47%，

1值为99.67%，相比其他算法模型的检测效果更好。在基于联邦学习的Webshell检测中，所提模型可在数据不出域场景下学习到各参与方数据，检测准确率由98.01%提升到99.01%。

Abstract

Webshell attacks were a common technique where attackers gained partial control over the Web server through a Webshell to carry out malicious activities. Due to the covert nature of Webshell operations and the continuous creation of new Webshell variants by attackers to evade security detection

coupled with the lack of information sharing and coordination between servers

uneven detection capabilities in responding to Webshell attacks emerged

making it difficult to establish a comprehensive and effective defense system. To address these challenges

a Webshell detection method based on federated learning was proposed. The method integrated the abstract syntax tree node value sequence features

code structure features

text obfuscation features

and cybersecurity expertise and experience features of Webshells. A TextCNN - based network model was designed to learn the malicious behaviors of Webshell samples. Meanwhile

the FedAvg algorithm of federated learning and the DP-SGD algorithm were employed for collaborative training across multiple participants without data leaving their domains. This ensured data privacy and prevented sensitive information leakage. Experimental results on the AMWD’22 dataset show that the model’s accuracy is 99.47%

with an F1 score of 99.67%

indicating better detection performance compared to basic algorithm models and existing research algorithm models. In the federated learning experiments

the proposed model could learn from the data of each participant without leaving the domain

increasing the detection accuracy from 98.01% to 99.01%.

关键词

Keywords

references

MICROSOFT . Web shell attacks continue to rise [EB ] . 2021 .

CISCO TALOS . Quarterly report: incident response trends in Q1 2023 [EB ] . 2023 .

HANNOUSSE A , YAHIOUCHE S . Handling Webshell attacks: a systematic mapping and survey [J ] . Computers & Security , 2021 , 108 ( 102366 ): 1 - 26 .

GIBERT D , MATEU C , PLANES J . The rise of machine learning for detection and classification of malware: research developments, trends and challenges [J ] . Journal of Network and Computer Applications , 2020 , 153 ( 102526 ): 1 - 22 .

SUN G , SHU H , SHAO F , et al . FKD-med: privacy-aware, communication-optimized medical image segmentation via federated learning and model lightweighting through knowledge distillation [J ] . IEEE Access , 2024 , 12 ( 3 ): 33687 - 33704 .

FRIHA O , FERRAG M A , BENBOUZID M , et al . 2DF-IDS: decentralized and differentially private federated learning-based intrusion detection system for industrial IOT [J ] . Computers & Security , 2023 , 127 ( 103097 ): 1 - 18 .

LIU Z , SUN H , SONG J , et al . Vertical federated learning architecture for power company and financial company and electricity pricing model considering user credit evaluation [C ] // 2023 3rd International Conference on Consumer Electronics and Computer Engineering (ICCECE) . Guangzhou : IEEE Press , 2023 : 820 - 826 .

杨帆 , 孙奕 , 陈性元 , 等 . 基于同态代理重认证的可验证联邦聚合方法 [J ] . 网络与信息安全学报 , 2024 , 10 ( 3 ): 91 - 106 .

YANG F , SUN Y , CHEN X Y , et al . Verifiable federated aggregation method based on homomorphic proxy re-authentication [J ] . Chinese Journal of Network and Information Security , 2024 , 10 ( 3 ): 91 - 106 .

KIM Y . Convolutional neural networks for sentence classification [EB ] . arXiv preprint arXiv: 1408.5882 , 2014 .

MCMAHAN B , MOORE E , RAMAGE D , et al . Communication-efficient learning of deep networks from decentralized data [C ] // Artificial Intelligence and Statistics . Fort Lauderdale : PMLR , 2017 : 1273 - 1282 .

CROIX A , DEBATTY T , MEES W . Training a multicriteria decision system and application to the detection of PHP Webshells [C ] // 2019 International Conference on Military Communications and Information Systems (ICMCIS) . Budva : IEEE Press , 2019 : 1 - 8 .

CUI H , HUANG D , FANG Y , et al . Webshell detection based on random forest–gradient boosting decision tree algorithm [C ] // 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) . Guangzhou : IEEE Press , 2018 : 153 - 160 .

YONG B , WEI W , LI K C , et al . Ensemble machine learning approaches for Webshell detection in Internet of things environments [J ] . Transactions on Emerging Telecommunications Technologies , 2022 , 33 ( 6 ): 1 - 13 .

林锋 , 徐柳婧 , 陈晓华 , 等 . 一种基于多视角特征融合的Webshell检测方法 [J ] . 电信科学 , 2020 , 36 ( 6 ): 125 - 132 .

LIN F , XU L J , CHEN X H , et al . Method of Webshell detection based on multiview feature fusion [J ] . Telecommunications Science , 2020 , 36 ( 6 ): 125 - 132 .

ZHANG Y F , KANG H Y , WANG Q . MMFDetect: Webshell evasion detect method based on multimodal feature fusion [J ] . Electronics , 2025 , 14 ( 3 ): 1 - 19 .

FENG Z , GUO D , TANG D , et al . Codebert: a pretrained model for programming and natural languages [EB ] . arXiv preprint arXiv: 2002.08155 , 2020 .

郜洪奎 , 安通鉴 , 税雪飞 , 等 . ATWebshell: 基于对抗学习和长短语义感知的Webshell检测方法 [J ] . 数据与计算发展前沿 , 2022 , 4 ( 5 ): 68 - 76 .

GAO H K , AN T J , SHUI X F , et al . ATWebshell: Webshell detection model based on adversarial learning and long-short semantic awareness [J ] . Frontiers of Data & Computing , 2022 , 4 ( 5 ): 68 - 76 .

FENG P , WEI D , LI Q , et al . GlareShell: graph learning-based PHP Webshell detection for web server of industrial internet [J ] . Computer Networks , 2024 , 245 ( 110406 ): 1 - 10 .

章嘉昊 . 基于深度学习的Webshell检测算法的研究 [D ] . 南昌 : 南昌大学 , 2023 .

ZHANG J H . Research of Webshell detection algorithm based on deep learning [D ] . Nangchang : Nanchang University , 2023 .

AMWD' 22 -阿里云安全Webshell文本检测数据集[EB]. 2023 .

AMWD' 22 -alibaba cloud security Webshell text detection dataset[EB]. 2023 .

潘桐 , 陈伟 , 吴礼发 . 面向不平衡样本的物联网入侵检测方法 [J ] . 网络与信息安全学报 , 2023 , 9 ( 1 ): 130 - 139 .

PAN T , CHEN W , WU L F . IoT intrusion detection method for unbalanced samples [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 1 ): 130 - 139 .

ABADI M , CHU A , GOODFELLOW I , et al . Deep learning with differential privacy [C ] // Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security . Vienna : ACM Press , 2016 : 308 - 318 .

MACKAY D J C . Information theory, inference and learning algorithms [M ] . United Kingdom : Cambridge University Press , 2003 . 311 - 318 .

ZHANG H , LIU M , YUE Z H , et al . A PHP and JSP Webshell detection system with text processing based on machine learning [C ] // 2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) . Guangzhou : IEEE Press , 2020 : 1584 - 1591 .

DONG C , LI D . AST-DF: a new Webshell detection method based on abstract syntax tree and deep forest [J ] . Electronics , 2024 , 13 ( 1482 ): 1 - 15 .

LI T , REN C , FU Y , et al . Webshell detection based on the word attention mechanism [J ] . IEEE Access , 2019 , 7 : 185140 - 185147 .

HANNOUSSE A , NAIT-HAMOUD M C , YAHIOUCHE S . A deep learner model for multi-language Webshell detection [J ] . International Journal of Information Security , 2023 , 22 ( 1 ): 47 - 61 .

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

DP-FedDRC: differentially private personalized federated learning to alleviate dimension collapse

Survey on incentive-driven federated learning: privacy and security

Privacy-enhanced federated learning scheme based on generative adversarial networks

Privacy-preserving federated learning framework with dynamic weight aggregation

Anti-attack federated framework based on dynamic clustering and reputation evaluation

Related Author

Wang Minli

Zhang Yuhao

Hu Changhui

CHI Huanhuan

XIONG Ping

LIU Hengzhu

MA Xiao

ZHU Tianqing

Related Institution

School of Cyberspace Security (School of Cryptography), Hainan University

Faculty of Date Science, City University of Macau, Macau

School of Information Engineering, Zhongnan University of Economics and Law

Zhicheng College, Fuzhou University

Engineering Research Center of Cyber Security and Education Informatization, Fujian Province University

⁰