Webshell Detection Technology Based On Deep Learning

Webshell is a hacker tool written in scripting language.It is a key link in hacker attack.Once the server is written into the Web hell by the attacker,it will probably lead to the server being completely controlled by the hacker,which will lead to a serIes of serious consequences such as mining,hanging horses,data leakage,intranet penetration and so on.Webshell is flexible and easy to evade the detection and killing of security software.Although the accuracy of deep learning detection model is higher than that of traditional detection algorithm,the detection model is fragile and vulnerable to sample attack.Aiming at the vulnerability of Web hell detection model for in-depth learning,this paper studies the causes of vulnerability of the model,and conducts research and experimental verification in attack and protection.The main research results are as follows:(1)A new method of contaminating data sets by using word bag controllable spillover is proposed.By using a hidden security hazard of word bag extraction algorithm,a controllable word bag spillover can be generated,which can achieve the denial of service attack effect in the training stage of the model.(2)A fast method of generating countermeasure samples is proposed.By searching countermeasure words randomly in reverse corpus and combining script language program grammar,the countermeasure features which are difficult to filter are constructed and injected into Web hell to achieve the attack effect of killless in-depth learning detection mode·(3)A feature-enhanced Web shell detection model is proposed.By fusing machine features and artificial features,the model improves the non-linearity and expressive ability of the detection model as a whole.The data set used in the experiment is GitHub Open Source Webshell Collection Project.The experimental results show that the fusion model not only improves the accuracy of the original model,but also can prevent sample attacks to a large extent,and can still learn better on the data set with superimposed interference noise.