Research And Implementation Of WebShell Detection Method Based On Deep Learning

With the progress of the times and the development of Internet technology,network applications are widely used in various fields,and are more and more closely connected with daily life.The network security problems caused by network applications have become more extensive and serious.Nowadays,the mode of network attacks has gradually changed from the traditional decentralized attack mode to the targeted continuous attack mode.This mode of network attack is not easy to be detected,it is very harmful,and usually leaves a backdoor program to facilitate subsequent network attacks.WebShell is a backdoor program based on network applications.It is an important part of network attacks.After a network attacker successfully compromises a network application,he can obtain server control authority through WebShell to carry out continuous attacks,causing serious consequences.This thesis studies and implements the WebShell detection method based on the public WebShell text data collected from the Internet.The existing WebShell detection methods in industry and academia have defects that cannot fully extract the semantic features of WebShell text and the semantic features of irregular structures.In response to these shortcomings,this paper has done the following work:(1)Investigate and analyze WebShell text data,use the non-original text features of WebShell text data,introduce the Bert pre-training model with the ability to dynamically build word vectors,mine the semantic features of WebShell raw text data,and build a static pre-training model to build word vectors.Experimental comparison.(2)The classification model of the existing WebShell detection method can well extract the semantic features of the regular structure in the WebShell text data,but cannot well mine the semantic features of the irregular structure.Therefore,this research topic introduces the graph convolution based the deep learning model mines the semantic features in the WebShell text data,and constructs the traditional WebShell deep learning classification model for experimental comparison.Through experimental comparison,the effect of the word vector constructed by the Bert model in this research topic is better than the word vector constructed by the Word2vec model and the Glove model.The introduction of the TextGCN model to complete the WebShell detection task,compared with the TextCNN model and the TextRNN model,effectively improves the accuracy of WebShell detection.